Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.
They also had a smart contract which didn't do some proper checks, but the hack was only possible with the stolen private key. Whoever held the private key was able to mint a lot of money, unchecked.
So there was a traditional hack at the core of this heist, not just a smart contract exploit.
Usually I would expect proof for a positive - like that it was an inside job, or there being an indication of it. I'm not saying whether it was or not, just that it seems unusual for you to ask about proof of it NOT being an inside job.
When it comes to crypticurrencies, no, the "hack" that turns out to be an inside-job rugpull is so common that the correct burden of proof is on the people who think this wasn't an inside job.
You shouldn't have a key that controls millions/billions of dollars on a cloud service. It should be on an airgapped laptop that was purchased anonymously, has never been connected to the Internet, and only runs software that has been vetted and loaded onto it via a CD-ROM or some other comparable method.
Most Treasuries are held by US banks, investment firms and municipalities. I'm pretty sure those firms hold a good chunk of global stablecoin volume, given the nonexistent regulation of crypto in the US relative to other countries.
No-one in the real world wants to be paid with a $USR. Most everyone wants a cashapp/zelle/PayPal/wire transfer. The bullshit payment systems gained ground on crypto while crypto became more difficult/less usable
I don't know what USR is, but I would prefer to be paid in USDT or USC if Wealthsimple supported it as deposit method. When I withdraw, I do Deel -> Wise -> Interac e-Transfer -> Bank -> Interac e-Transfer -> Wealthsimple. This is incredibly stupid and I am forced to buy Canadian dollars. For groceries or electronics, you can buy gift cards using crypto.
If you track the FATFs crushing of bearer bonds, bearer notes, non-KYC/non-AML offshore banking, and Hawala it almost perfectly tracks with the rise of crypto.
But you do have to deal with bullshit payment systems. I can't receive stablecoins in my regular bank account, I'd have to set up some crypto nonsense on DankRocketBets or whatever for it to even work.
Why would I do this when I can already receive actual USD without any extra ceremony?
Stablecoins are a solution in search of a problem.
The problem presents itself when you have dirty money to launder. It isn't a product for non-criminals but they have to convince enough gullible people to participate and blend in with them.
If your employer does direct deposit of USD into your USD bank account, you don't need stable coins. This is not the case for most people outside of the U.S.
Most people don't realize they're inside a plexiglass shielded financial jail until they try to do something like wiring money for some legal activity in someplace spicy or on the FATF grey list.
If you fall into the middle bands of uses, or in the upper class that can just bend or make the rules, then the financial system is well oiled and it looks like the people questioning it are just cranks.
It's true that a lot of those in the outer bands are criminals but others are things like "buying a truck to build an orphanage for starving Iraqi children just outside of terrorist territory" or "wanted an investment visa in some corrupt island paradise and as it turns out no bank will open up account for purposes of 'international wires to the Comoros' "
Oh yeah, "most people outside the US" are looking to build orphanages in deeply sanctioned war zones. How could I have forgotten.
Come on now, that's absurd. If this is your best use case for stablecoins - groping for concocted scenarios to rationalise their existence
- I stand by what I said earlier: they're a solution in search of a problem.
One of the two is very close to something that actually happened to me. I tried to open up a bank account for paying immigration related costs to a particular shithole country, which is both legal and was part of a fully legal endeavor, but no bank would do it.
The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
It's really not absurd. As soon as you start trying to do anything interesting the KYC/AML burdens get greater until eventually you realize the compliance officers are just trying to get you to go away (or just deny you outright), get interesting enough and then suddenly despite fully complying with the law you find the walls are closed around you. Most people never find out because they never have occasion to try, they do a bunch of boring domestic transactions plus maybe some international trade with a few well known entities, then they just shout people are making up absurdities.
Clearly your situation of trying to obtain residency in the Comoros by investment would raise eyebrows at banks whose job it is to monitor tax compliance. I don't think you're describing an everyman kind of scenario.
I also don't entirely understand why you're even rationalising the purpose of the account to the bank. Can't you just open an account for any purpose? It takes me five minutes to open an account online, and I've never once been asked to explain or justify anything (in many decades). I use my accounts robustly, including for international transfers (I've lived on two continents in the last four years). I even once paid for a trip to North Korea out of an ordinary bank account. My bank never batted an eye.
Maybe you're just dealing with a bad bank, or an over-regulated banking system (Europe?). You realise you can walk into any US bank right now and they'll just open an account for you with nothing more than some accurate ID? And the same holds for much of the rest of the world? The problem you're trying to solve is already solved.
>> The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
Unsophisticated semi-literate farmers are the last demographic anyone is reasonably expecting to open their crypto brokerage accounts and start trading synthetic USD derivatives.
These are just not realistic scenarios. This is what people say when they rack their brains trying to come up with some reason stablecoins might be useful. I feel like you're just confirming that they're a solution in search of a problem.
Pick an FATF grey list country that isn't sanctioned by your country. Then try to wire money there. Let me know how it goes and whether you really aren't asked to explain anything.
Stablecoins enable cash-like (instantly redeemable and verifiable) payments for large amounts, for almost free.
In EU countries, you can't now buy a car with cash. You have to buy a bearer's check from your bank, which is expensive, requires that both parties have a brick and mortar bank, and doesn't work cross-border. Stablecoins solve this.
Makes it easier to do pump and dumps, was never about "privacy" or "decentralization" as web3 types parroted 4-5 years ago. Monero is the exception btw.
I mean they use Blockchain, right? Isn't that like the only real requirement for the name crypto?
As long as you burn as much electricity as Andorra does in a week just to make a transaction, you're probably a cryptocurrency. And that's their sole benefit it seems.
>I mean they use Blockchain, right? Isn't that like the only real requirement for the name crypto?
Absolutely not. Cryptocurrently exclusively refers to permissionless, decentralized, cryptographically secured, irreversible, fungible monetary system with a disinflationary or non-inflationary supply, following a voluntary, collectivized governance model.
A vast majority of tokens colloquially referred to as "cryptocurrency" couldn't be further from these principles. There are no stablecoins that are cryptocurrency. Ethereum is not cryptocurrency. Any coin issued by a corporation (e.g. Ripple) is not a cryptocurrency.
Is there even any currency that meets that definition? Iirc even bitcoin had some kind of reversal back in the day, or am I misremembering? I seem to recall bitcoin splitting in 2 for a while as there was some disagreement on whether the reversal should be made or not.
Ethereum is a great utility token. Smart contracts absolutely have utility in the digital economy. It's just not a cryptocurrency, is all. It had a massive premine, there's no supply cap, it's subject to OFAC censorship, and has effectively demonstrated that just ~4.8% of the total ETH supply can vote to cause rollout and widespread adoption of a fork that reverses transactions.
We need different words for these fundamentally different things, because conflating them causes real confusion, as this very hack demonstrates. People are surprised that an admin can lock transactions precisely because the word "cryptocurrency" led them to assume properties that don't exist in stablecoins.
I don't know how this specific thing works, but I don't really see any fundamental problem with mixing and matching. If you believe in the benefits of crypto, then 50% crypto is still possibly better than 0%.
It's not like I forgo a lock on my front door just because my windows are made of glass.
Not really. At a traditional bank I have to trust n people with varying degrees of access. Et ceteris paribus, any reduction in n is an improvement, even if n is not zero.
Of course n can be smaller and the specific people less trustworthy, but that's quite a different thing.
At a traditional bank you have your national deposit insurance scheme; you get that in return for converting your "assets" to the said nations issued currency but accept the authorities control of the money supply and your funds.
With decentralised money, you get the safety of a globally distributed attestation backed by cryptography without a single authority controlling the supply of money or your funds.
There is no halfway option. You either have a single authority that can exercise control or you do not; number of delegates for exercise of control is almost irrelevant since you can change banks.
That access is to provide account support, no? Reverse fraudulent transactions and the like. A "bank" could just not do that save for if you're a large enough client to merit attention but why would I want to bank there if I'm not a large enough client?
FDIC deposit insurance does not protect against losses due to theft or fraud, which are addressed by other laws.
That's covered by private bankers bond insurance, much like you could get for a decentralized stored pots of gold or you can buy insurance in the form of put options (like on IBIT) on the loss of value of bitcoin or if your cold wallet is stolen you can initiate legal proceedings against the thief.
That's good to know. I guess that makes sense though as those swindled by Madoff had to recoup their money through Madoff's estate instead of FDIC.
I guess Hollywood has mislead us yet again in pretty much every bank robbery scene with dialog like "Nobody panic. We're not stealing your money, we are stealing the bank's money".
What is the point of stable coins? Like why does anyone buy them?
It seems to me that their initial value is 1usd per token (or some other fiat I guess) and that's also the roof of their value: they kinda guarantee that they won't become more valuable than that.
They are less usable than fiat: more businesses accept fiat than crypto, especially weird and small coins like all stable coins are.
There isn't really a floor to their value, as demonstrated here.
I see plenty of downsides of owning one of these coins, but not a single upside?
Yet people apparently do buy them, so what is the upside? There must surely be something that's good about them?
The main use is just having something dollar-like that you can move around easily. That’s useful outside the US, but also for plenty of people inside the US depending on what they’re doing; especially businesses that have a hard time getting or keeping normal banking (cough gambling, porn, weed cough).
They’re handy inside crypto since you can move in/out of other assets without touching a bank. And sometimes you can earn yield on them, which is part of the appeal (with the usual “this can blow up” caveats).
Also, there’s a reason every company wants to launch one: if you control the stablecoin, you get the float and the rails. That’s a pretty nice business if people actually use it.
If you already have solid access to USD and don’t care about that flexibility, they’re less compelling.
But yeah, not risk-free at all (depegs, issuer risk, etc). And honestly there probably isn’t much real need for dozens of slightly different stables beyond the business incentives.
Stablecoins present less frictions, have cheaper transaction costs and less intermediaries susceptible to block them. It greatly increases the velocity of money.
What utterly horrendous payment solutions are you using that have more friction than crypto?
The ones I use are several orders of magnitude less friction and most are 100% free. The ones that do have a cost (for recipients outside Scandinavia basically) are still way, waay cheaper than crypto transactions.
I think the idea is if you're attempting to actually use crypto in the way that you would normally use money (ie, to buy/sell stuff) then you don't want the volatility. So in theory, it takes away the volatility while living within the crypto ecosystem.
But obviously...things happen. Just like cash is usually relatively non-volatile, but financial crashes happen.
Let’s be honest, it’s principally for illicit use, a tiny fraction of privacy folks and then a lot of people caught in between who don’t understand yield but want to bet on a volatile asset and have to use a stablecoin to go between. (Because the backers of the volatile thing are doing something illicit.)
> stablecoins are commonly used in international trade
For a rounding error value of "commonly," sure. (Catering to a financially-constrained market is good business. But it, by definition, will never be an important one in the grand scheme of things.)
Has to be an inside job. One doesn’t just simultaneously hack into an AWS account, know exactly which key is needed for coin minting, and know internal details necessary to exploit a smart contract. The nature of the hack practically reveals their identity.
Not that it matters much, but this summary isn't right. The contract wasn't "exploited." The company's AWS account was compromised, giving the attacker access to a (off-chain) private key.
The contract relied on the key to mint new tokens. The hacker gained access to the key (through AWS) and with it minted as much as they'd like. It is certainly a valid take that a contract that only required the private key to mint an unlimited amount of the token isn't a good one, but you don't exploit someone's front door lock by grabbing the key from under the welcome mat.
Yeah, people who genuinely believe that don't have any problem with smart contracts getting exploited. Of course there are people who _say_ that because it's financially expedient at the time, then change their tune. But both groups exist and this is not really a gotcha.
The contract code said, "if you have a valid (off-chain) private key, you can mint tokens." The hacker gained access to their AWS account and ultimately their keys.
While I am happy to celebrate dumb crypto stuff, this isn't a situation where someone's code was "exploited." Their code was stupid, relying only on an off-chain private key to allow the minting of tokens. Their security was just also bad.
A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment
https://xcancel.com/zacodil/status/2035658779706974556
They also had a smart contract which didn't do some proper checks, but the hack was only possible with the stolen private key. Whoever held the private key was able to mint a lot of money, unchecked.
So there was a traditional hack at the core of this heist, not just a smart contract exploit.
But for online armchair speculation, you have to admit it seems a likely explanation.
You can criticize their design, but you can't have a dude burning a CD-ROM every time someone wants some coins.
Why would I do this when I can already receive actual USD without any extra ceremony?
Stablecoins are a solution in search of a problem.
Waiting to hear what "most people outside the US" are supposed to need those stablecoins for.
If you fall into the middle bands of uses, or in the upper class that can just bend or make the rules, then the financial system is well oiled and it looks like the people questioning it are just cranks.
It's true that a lot of those in the outer bands are criminals but others are things like "buying a truck to build an orphanage for starving Iraqi children just outside of terrorist territory" or "wanted an investment visa in some corrupt island paradise and as it turns out no bank will open up account for purposes of 'international wires to the Comoros' "
Come on now, that's absurd. If this is your best use case for stablecoins - groping for concocted scenarios to rationalise their existence - I stand by what I said earlier: they're a solution in search of a problem.
The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
It's really not absurd. As soon as you start trying to do anything interesting the KYC/AML burdens get greater until eventually you realize the compliance officers are just trying to get you to go away (or just deny you outright), get interesting enough and then suddenly despite fully complying with the law you find the walls are closed around you. Most people never find out because they never have occasion to try, they do a bunch of boring domestic transactions plus maybe some international trade with a few well known entities, then they just shout people are making up absurdities.
I also don't entirely understand why you're even rationalising the purpose of the account to the bank. Can't you just open an account for any purpose? It takes me five minutes to open an account online, and I've never once been asked to explain or justify anything (in many decades). I use my accounts robustly, including for international transfers (I've lived on two continents in the last four years). I even once paid for a trip to North Korea out of an ordinary bank account. My bank never batted an eye.
Maybe you're just dealing with a bad bank, or an over-regulated banking system (Europe?). You realise you can walk into any US bank right now and they'll just open an account for you with nothing more than some accurate ID? And the same holds for much of the rest of the world? The problem you're trying to solve is already solved.
>> The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
Unsophisticated semi-literate farmers are the last demographic anyone is reasonably expecting to open their crypto brokerage accounts and start trading synthetic USD derivatives.
These are just not realistic scenarios. This is what people say when they rack their brains trying to come up with some reason stablecoins might be useful. I feel like you're just confirming that they're a solution in search of a problem.
In EU countries, you can't now buy a car with cash. You have to buy a bearer's check from your bank, which is expensive, requires that both parties have a brick and mortar bank, and doesn't work cross-border. Stablecoins solve this.
As long as you burn as much electricity as Andorra does in a week just to make a transaction, you're probably a cryptocurrency. And that's their sole benefit it seems.
Absolutely not. Cryptocurrently exclusively refers to permissionless, decentralized, cryptographically secured, irreversible, fungible monetary system with a disinflationary or non-inflationary supply, following a voluntary, collectivized governance model.
A vast majority of tokens colloquially referred to as "cryptocurrency" couldn't be further from these principles. There are no stablecoins that are cryptocurrency. Ethereum is not cryptocurrency. Any coin issued by a corporation (e.g. Ripple) is not a cryptocurrency.
Idk, it's been a while and my memory is fuzzy.
We need different words for these fundamentally different things, because conflating them causes real confusion, as this very hack demonstrates. People are surprised that an admin can lock transactions precisely because the word "cryptocurrency" led them to assume properties that don't exist in stablecoins.
It's not like I forgo a lock on my front door just because my windows are made of glass.
Blockchain with central authority is the worst of both worlds.
At least when I report fraud to credit card or my bank, they can stop or undo/chargeback a transaction.
Of course n can be smaller and the specific people less trustworthy, but that's quite a different thing.
With decentralised money, you get the safety of a globally distributed attestation backed by cryptography without a single authority controlling the supply of money or your funds.
There is no halfway option. You either have a single authority that can exercise control or you do not; number of delegates for exercise of control is almost irrelevant since you can change banks.
[] https://www.fdic.gov/news/fact-sheets/crypto-fact-sheet-7-28...
I guess Hollywood has mislead us yet again in pretty much every bank robbery scene with dialog like "Nobody panic. We're not stealing your money, we are stealing the bank's money".
It seems to me that their initial value is 1usd per token (or some other fiat I guess) and that's also the roof of their value: they kinda guarantee that they won't become more valuable than that.
They are less usable than fiat: more businesses accept fiat than crypto, especially weird and small coins like all stable coins are.
There isn't really a floor to their value, as demonstrated here.
I see plenty of downsides of owning one of these coins, but not a single upside?
Yet people apparently do buy them, so what is the upside? There must surely be something that's good about them?
The main use is just having something dollar-like that you can move around easily. That’s useful outside the US, but also for plenty of people inside the US depending on what they’re doing; especially businesses that have a hard time getting or keeping normal banking (cough gambling, porn, weed cough).
They’re handy inside crypto since you can move in/out of other assets without touching a bank. And sometimes you can earn yield on them, which is part of the appeal (with the usual “this can blow up” caveats).
Also, there’s a reason every company wants to launch one: if you control the stablecoin, you get the float and the rails. That’s a pretty nice business if people actually use it.
If you already have solid access to USD and don’t care about that flexibility, they’re less compelling.
But yeah, not risk-free at all (depegs, issuer risk, etc). And honestly there probably isn’t much real need for dozens of slightly different stables beyond the business incentives.
That... Actually makes sense.. Which is a rare feat for crypto!
The ones I use are several orders of magnitude less friction and most are 100% free. The ones that do have a cost (for recipients outside Scandinavia basically) are still way, waay cheaper than crypto transactions.
But obviously...things happen. Just like cash is usually relatively non-volatile, but financial crashes happen.
For a rounding error value of "commonly," sure. (Catering to a financially-constrained market is good business. But it, by definition, will never be an important one in the grand scheme of things.)
"Only" ?!!! Poor thing.
> Trump Administration Likely to Un-ban Bitcoin Mixers, Dept. of Treasury Says They are “Not Unlawful”
https://bfmtimes.com/trump-likely-to-un-ban-bitcoin-mixers/
Now, as to why the SEC hasn’t regulated crypto out of existence.. I refer you to dementia Don
The contract relied on the key to mint new tokens. The hacker gained access to the key (through AWS) and with it minted as much as they'd like. It is certainly a valid take that a contract that only required the private key to mint an unlimited amount of the token isn't a good one, but you don't exploit someone's front door lock by grabbing the key from under the welcome mat.
I also dont mind the whole chain coming together to vote to reverse the transaction.
I also dont mind a bunch of people being unhappy with that and forking.
While I am happy to celebrate dumb crypto stuff, this isn't a situation where someone's code was "exploited." Their code was stupid, relying only on an off-chain private key to allow the minting of tokens. Their security was just also bad.