logoalt Hacker News

FitchApps • yesterday at 7:37 PM • 1 reply • view on HN

It's so crazy. As a user, you need to triple authenticate with all sorts of gates to withdraw money but here's a dev guy who can just magically, without any secondary authorizations (as far as I can tell), transfer billions. No devops/sys admin should have access to live wallets with real funds


Replies

andoando • today at 8:07 AM

Its more possible devops guys had access to something like AWS secrets or API tokens or some tool that generates API tokens or access to CI/CD which could grab access to one of the above