alt Hacker NewsI'm stunned that they had that much cryptocoin online to be stolen. Why didn't they put it in "cold storage" and only some information in the database which says how much each customer had?
OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
Replies
Each customer's funds aren't keep in individual wallets. It's pooled into a wallet controlled by the exchange.
Exchanges do put most of the assets in a cold storage. Binance has $155B in assets and handles $14B of trade volume in 24 hours so not all of it are in a cold storage.
AFAIK they gained access to a DevOps guy's laptop with too many privileges and just made a bunch of withdrawals into their own wallets, so they have their keys.
The only hope is that most of it gets frozen in some way or another, but if even only 1% gets through they'll still have made about $65M
> OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
You’re misunderstanding where these coins were taken from/are now. Of course they did not get access to customer private keys, because in an exchange there isn’t really such a thing. You’re trusting the exchange to hold the coins for you, and they get put into a shared wallet that they manage with the exchange’s key.
Even if they did not have access to the exchange’s private keys and only got access to some API that let them execute the transfers, it doesn’t matter anyway, as the attackers transferred the coins into new addresses with keys controlled by them, so they’re free to move them now.
…well, mostly, the stolen USDC and USDT coins got frozen by the issuers, but those are not really decentralized as much as they are built on top of decentralized infrastructure.