When you DeFi you make fat stacks in secs if you grab a flash loan using anonymoused code bits and then trade them to these other deflationary-on-trade bits so your precoded automated loanbot can gulp, buy a weiBit and another until there's no more to buy
which are simultaneously and instantaneously determined to have value far greater than they were thought to have in the line of code just above bc there is no time in flash loan land and scarcity=value and value=scarcity and what you really want is
the bits that rep the governance of the protocol that permissionlessly allows for the creation of the pools of arbitrary anythings that you just loanbotted to 1/10^18 above zero bc they get rewards distributed via chat app and meatballs using the mighty trusted gecko oracle and
they only really have value bc AMM works both ways and brains do too and the market trusts meat more than the trustless system used to create the market and the belief in receipt grants you piles of these bits so you
repay the Schrodinger's loan you took out originally (or didn't take out) in this very second in time as well as paying the anti-ddos mechanism that similtaneously incentivizes borderless bots in all jurisdictions to agree that this did indeed happen and there's no going back.
Then you just go to the decentralized permissionless unicorn to sell those bits at a rate the market algorthim sets for new original code bits x 10^6 and tornadoing to safety yeah now you're rich #fomo it bro #flashloans4lyfe#defi#bitcoinisforboomers#whatcouldgowrong
• • •
Missing some Tweet in this thread? You can try to
force a refresh
At some point prior to July 2024 the actual hackers landed a backdoor onto something that gave them some access to the WazirX multisig signers and/or their signatures.
We don't know what or who was compromised and it doesn't really matter.
Initial toehold was likely gained by tricking someone at WazirX or Liminal into installing malware -> escalated from there.
This access allowed the hackers to intercept/insert invisible, malicious payloads for signing in a way where none of the 3+ signers were able to notice.
With the recent sophisticated hacks fresh on everyone's mind, there's been a lot of talk about ✨fancy stacks and setups.✨
Yes, you should evaluate how—and with what—you sign txns.
But building a custom UI for your LAN Qubes OS AWS KMS everyday is not really the answer 😅
Background on the referenced hacks (feel free to skip):
1. Funds were stolen from each org's multisig.
2. Keys themselves were not compromised.
3. In Radiant and WazirX and maybe DMM, the keys backing the multisig were actually only on hardware wallets + actually controlled by distinct parties.
DMM Bitcoin - $305m in May
The least amt is known about DMM, including whether keys were cold vs hot. Early theories said address poisoning. It def wasn't that. Attached is rampant speculation (likely all wrong)
See also: x.com/mononautical/s…
Also, note, any organization that can implement / enforce EDR, etc. should do so. Full stop. End of conversation.
However, the crypto industry generally considers this a non-starter for all sorts of philosophical + practical reasons.
Crypto folks (hopefully) already know that Lazarus is one of the most prevalent threat actors targeting this industry.
They rekt more people, companies, protocols than anyone else.
But it's good to know exactly how they get in. Bc another smart contract audit won't save you.
For example, one long-time fave method:
- Contact employee via social/messaging app
- Direct them to a Github for a job offer, "skills test," or to help with a bug
- Rekt individual's device
- Gain entry to company's AWS
- Rekt company (and their users)