alt Hacker NewsNobody in the entire company should have access to move $billions in crypto, much less a random engineer, even if they're part of the deploy process.
Replies
fhn • yesterday at 10:56 PM
most employees shouldn't be able to touch the funds at all except a handful and probably require supervisor verification (dual factor authentication).
ffsm8 • yesterday at 5:14 PM
I mean sure, but as long as you can deploy directly any permissions models are meaningless for an attacker? They can just be removed.
They had controls in place to prevent large transfers, so the attackers structured it as a lot of small transfers very quickly