저자: Kevin · 외국인
요약 보기
바이비트 해킹(약 14억 달러, 이더리움 약 3만 개)을 다루며, 바이비트가 '지급능력 충분'을 주장하지만 거래소의 1:1 담보 주장은 불충분한 검증이라고 비판. 뱅크런 조짐과 출금 지연을 지적하며 최근 몇 시간~며칠 내 붕괴 가능성을 언급. 해킹 원인은 하드웨어 지갑 미사용 등 검증 절차 미흡으로 추정. 나스닥도 공포심리로 당일 2% 하락했다고 언급.
다듬은 글
We just had one of the largest cryptocurrency hacks ever. This is not good and I'll tell you I feel like crap, but we got to cover this. I wanted to take a nap and I'm like, what? $1.4 billion hacked? Holy smokes, this is not a joke at all. Look at this after all. This is the history of cryptocurrency hacks.
We've got the Ronin hack of 625 million, Poly Network 611, Binance uh Bridge 569, Coincheck 532, FTX 477, Mt. Gox was 473, Wormhole 325. The Bybit hack right now $1.4 billion. It's the largest out of this list. And if you add it all together, makes up a large chunk of pain. So, what happened and how could a hack like this potentially be prevented?
What potentially went wrong? And what has Bybit said about this hack thus far? And who the heck done it? Well, obviously we don't know who done it. We do know their wallet address and can you guess what the wallet is doing? Um if you guessed sending it to a bunch of different wallets, yep. That's exactly what's happening.
There you go. Hacker address, good luck. Now, the goal is obviously to track all of these down. The thesis is that it will be very difficult for this hacker to actually liquidate the Ethereum to a USDC or a Tether because uh Circle or the other involved entities would just end up freezing the funds.
So, instead they might have to just distribute this to many different people, change it uh you know, throw it into a Tornado Cash, change it to different cryptocurrencies and just buy things strictly with cryptocurrency. Uh but, what the hacker does with the money is less important because recovery is very, very difficult for situations like this.
Uh instead, what we should think about is what's going on with customers and what's going on with Bybit. So, let's get started with that. So, I just listened to about an hour and a half of the uh Bybit uh explanation of what happened uh and it's a lot. The most important thing that we know so far is that Bybit suggests they're experiencing a bank run.
But, they say that all of their assets are safe. Now, I've heard this before and I tweeted about this. I made a joke, "Fool me once, shame on you. Fool me twice, shame on me." I've been fooled by this sort of stuff before, but let's put it this way. When we look here, what do we find? FTX back uh you know, a couple years ago, "FTX is solvent.
It always has been. There's no problem." CEO of Bybit, "Bybit is solvent with a capital S. Even if this hack loss is not recovered, all client assets are backed one-to-one and we can cover the loss." Okay. So, there are a couple things here to know. When when cryptocurrency exchanges tell you that assets are backed one-to-one, usually what they've done is they've done some sort of proof-of-reserve study.
Uh these are very, very basic-level audits and they usually work something like this. Let's say you have $100 in cash and then you have deposits of $100 of Bitcoin, $100 of Solana, $100 of Ethereum. Individually, you have $100 to cover those Bitcoin deposits. But, you don't have $100 to cover if all three of these got called away, hacked, margined, whatever.
The other thing that's very important to know is uh the executives at Bybit are saying, "Hey, you know, this isn't a big deal. We have $20 billion of assets. This is just one and a half. We have retained earnings. We can handle this. This is just 1/20th of the money that we have." Hold on a second. When a company has $20 billion of assets under management, that doesn't mean you have $20 million to spend however you want.
It's not your money. Something to know, when you run a fund and you take deposits from people, you might take like somebody can hand you tomorrow a billion dollars and say, "Hey, here's a billion dollars." Technically, on your balance sheet, you have a billion dollars of cash, of assets, right? Does that make you a billionaire?
No, because on your balance sheet, you would also show a liability. I now owe this person $1 billion back. So, technically, if you have $20 billion of assets under management, you also have $20 billion of liabilities because you owe people their money back. So, if you lose 1 and 1/2, and you can't do anything with the 20 in assets you have cuz you already owe that 20.
So, those zero out. So, now if you lose 1 and 1/2 and you got to pay people back, you got to either borrow or take it from the other cash you have. And guess what Bybit is doing? Well, they stated that we have the money. We're not going to be buying Ethereum. Instead, we are taking a bridge loan to cover 80% of the assets from our partners.
And they said, quote, "Even if we are experiencing a bank run, which we already experienced in the last 2 hours, it's not an issue." I've heard of lines like this before. Don't worry, you don't need to take your money out. Everything is fine. We're processing withdrawals as normal. We've heard this all before.
And then what happens? They start slowing down certain transactions, usually the big ones. And guess what Bybit is doing right now? They're slowing down transactions. In fact, they're saying that most people are getting their withdrawals out. However, not everybody because some people just need to be patient.
They need to wait a few hours to make sure that they can get all of their money out because they're verifying those transactions. My guess is that's probably a set of larger transactions that are going to be held up. You know, somebody wants to withdraw 100 bucks, it's not going to be as big of a deal, right?
It's going to be more manageable. But, if you're trying to take out a larger amount, you're going to have an issue. Let's listen to how they say So, uh you know, even if we are experiencing a bank run, uh you know, which we already witnessed in the in the previous 2 hours, Jeez. uh uh it's not an issue.
Uh we have enough uh uh uh tokens to give to the clients for withdrawals. Yeah, it doesn't give me a lot of confidence when you're saying that in the frozen-up posture. The frozen-up defensive posture. Everything's fine. You're hugging yourself because you know everything's not fine. This could be the end of Bipet.
Now, I'm not trying to, you know, go extreme here, but let's just put it this way. I personally, if I had my funds on exchange in 2025, I don't know why you would, but just in the event that you did, I probably wouldn't keep my money on the exchanges. Just like the warning I gave back in the day when FTX was collapsing.
I'm like, "You know what? I'd get my money out." It's the same warning that I gave before Voyager collapsed. It's the same warning I gave before uh cryptocurrency uh stablecoins started collapsing and BlockFi went down. Same warnings. Once it starts, it's really hard to stop. Now, the CEO also tried to explain how this hack took place.
And how the hack took place is a little bit concerning to me because it sounds like they got spoofed. Uh and it's not just that, and we'll have to speculate on what exactly happened, but the head of derivatives is on X live streaming from a hotel room that looks like it was shot up by the Taliban. Now, somebody replied to my comment about that on X and said, "He mentioned at the beginning of the live stream that his work colleague completely trashed his hotel room after hearing about the hack." And then I wrote, "I'm not sure if that gives me comfort or more concern." Let's streamline this.
If y'all screwed up so badly that the next thing you're going to do is resort to destroying a hotel room that's not yours, I get even more nervous. Oh, my goodness. All right. So, with that, let's now look at uh how this this potential link movement happened. So, the CEO of Bybit explains how they ended up verifying this transaction.
And I want you to hear the words for about 20 seconds, and then let's analyze it. to the warm wallet. Uh when we saw the transaction, it was business as usual. Um uh I can uh at least speaking for my part, I was the last signer of this transaction. Uh when this transaction came, it was a normal URL.
I I double-checked. It was the safe URL uh from the official safe website. We always use official website. Uh so, that was one of the safety protocols we we we deployed is to check. So, we checked I checked on that. I click on the link and checked. And then I checked on the UI the um the destination address uh to make sure that it is our uh warm wallet.
And we have a procedure to make sure that it is uh what we saw. So, all of that checked out, and the initial transfer that we made uh was around, I believe, 30,000 uh ETH. Uh 30,000 Ethereum. And you did not use a hard wallet to verify the destination you're sending the money to. See, here's the thing.
Extensions like MetaMask or Safe, they can have malicious updates made to them. We don't know if this happened. This is This is speculation. There could be errors or interceptions on the development end. There could be errors on your local devices. This could even be an insider job. Maybe somebody on the inside updated the template for the smart contract that essentially displayed through the UI, the user interface, the correct address, but actually sent the money to the wrong address.
One way you can mitigate 99% of these spoofs, because, you know, you still need a human to verify this stuff. One way you can mitigate a lot of these spoofs is by actually using a hard wallet. This would be a great place for a hardware wallet sponsor, but I I don't have one. But anyway, so anyway, let's say uh you had a hardware wallet, and you were going to verify this transaction.
All you would need is one of the four people multi-signing to run this through a hardware wallet. And then, what would they have seen? Well, they would have looked and seen that the actual destination address was different than what they expected it to be. Because that's one of the benefits of the hardware wallet.
I mean, you do get a lot of pages you have to go through, but one of them is, this is where the money is actually going, rather than a you like it bypasses your device, it bypasses your browser, it gives you a bottom line. Are you sure this is the address you want the money to go to? Now, there are many other things you could do.
You could use simulators, you could use smart uh smart contract decoders. There are plenty of ways you can verify that the smart contracts you're working with are actually legitimate. But a basic hardware wallet would have made it simple. And you just heard the CEO say, "Well, I looked on I clicked the link, and everything looked good." I heard that, and I'm like, "You're telling me you sent 30,000 Ethereum without a hardware device, some kind of security key, or anything off-device to verify the transaction?" Yeah?
Well, I mean, it looked right. It looked good. Now, this isn't to say that a mistake couldn't have also been made. I'm going to put something on screen. When I put this on screen, I want you to tell me, is there a difference between these two wallets, okay? And when I give you this on screen here, I want you to ask yourself how long does it take you in a realistic setting to find if there is any difference between these.
Now, you could run them through like a GPT and open AI or whatever, and use that. But I want you to pretend you're on a hardware wallet, you're stressed, you got a million emails or whatever, and at least you're trying with a hardware wallet, which wasn't the case here, apparently. Uh and you're comparing where you're expecting the signature to or the the transaction to go to and where your hardware wallet says, okay?
Ready? Going to put it up on screen. I'm going to give you 5 seconds to figure it out. Where's the difference? Is there a difference? Maybe there's not even a difference. 5, 4, 3, 2, 1. Did you see it? They're different. Okay? It's really hard. Right here. You expect this to be XYZ, it's actually XYY.
It's crazy It's like maybe you saw it right away. Maybe you got those perfect eagle hawk eyes, in which case I'm proud of you. I don't have that. I'm just saying. It is kind of hard to verify some of these hashes, and I'm not trying to make excuses. Just saying it does get a little bit easier if at least you take the step of using a hardware wallet.
The reason I'm bringing this up though is because it shows that there can still be a failure even if you're using a hardware wallet, because you can still get spoofed. But this would be human error as opposed to being lied to by what your user interface is showing you. So, we don't know with certainty, but it sounds like there I mean here's this is speculation, okay?
There could have been an insider that changed the template. Uh maybe somebody who was paid. Uh somehow maybe somebody delivered them a you know an unofficial Chrome extension or whatever that had a malicious template. Uh that was essentially able to execute into their wallet extension, probably the first signer.
Uh that modified the contract for everyone and then everybody signed off on it. Four signers. I don't know. And and time will tell what it is. But again, just as sort of an outsider outside of this company, I I cannot believe that there was no hardware verification. This is just a battery, mind you.
Um that there was no hardware verification for a 30,000 Ethereum transaction. But anyway, other things to hear here. So, uh they say that uh everyone is affected, but your assets are safe. When they're asked, are we covered one to one? Uh they said, we will do whatever we can to cover the Ethereum exposure.
We don't know if we're going to be able to get our hands, you know, on on the money again. Uh who's affected? To be honest, everyone is affected. Worth noting that Bybit was launched in 2018. They said they likely won't be buying Ethereum. Uh they keep talking about how much they have in AUM, but I don't think I think they're just trying to do that to placate people who don't understand what assets under management are, but I've already explained that.
Uh you know, this this theoretically could have been some kind of like malicious message or download that they got. You know, so you have to be obviously very careful clicking links or or you know, downloading uh unauthorized software, which should be pretty obvious. Again, which is why I'm just like how how could this happen?
It could have just been as simple as an insider, right? The first signer, maybe, who knows? Gets paid, hey, we'll send you 20 million bucks, you can retire, go to you know, we'll fly you somewhere and uh you know, get get the contract modified to look like this the next time you all need to move money from your cold wallet to your warm wallet.
That's what they call it by the way, that's basically from storage to here's our actual operating bank account so to speak. Uh and they needed to top it off because maybe they were experiencing withdrawals for just normal ordinary everyday reasons. Now all of a sudden they're in there where it's quote-unquote experiencing a bank run.
So I would expect over the next uh probably 24 to 72 hours, if they don't freeze withdrawals within the next 24 to 72 hours to just kind of like get stabilized, they'll probably collapse. That's probably why they got a bridge loan because their investors know, okay, if we don't bail the situation out right now, they're going to collapse.
So the next hours will be very critical for them. If they can survive and get through this with enough lending and people don't withdraw too much from the platform, uh because again, withdrawals past what was lost aren't actually that bad because you know, if you have 20 million in assets under management and somebody wants some of that money back, you just give it back to them.
That's not that bad. Like people can take their money out because you have it, assuming you have it. But the part that you lost is the problem. And so if everybody who had deposited Ethereum that is now lost wants to withdraw their one and a half billion dollars, they have to really quickly raise one and a half billion dollars to cover that.
All of the excess above that would just be a normal withdrawal, which they could process. The problem is, are they going to go bankrupt by not being able to process the withdrawals of the money they lost and then they run into a panic situation where all the other depositors leave because they're also rightfully concerned uh and then they can't make money anymore off fees to sustain their business.
Now, all of a sudden their expenses are higher than their income, and now you're burning even more money, making it even harder to get your money back. Just an example of how that works, but anyway, this is a sad day uh for the crypto industry. It's also sad day for the Nasdaq. It's down 2% today on a whole lot of fears.
There's a lot of fear and uncertainty and doubt and and stuff going on today, but uh anyway, look, I appreciate y'all being here. Uh you know, check out my courses on building your wealth over at meetkevin.com if you want to be part of my course member live streams in the morning, and um we'll see y'all soon. Really appreciate you. Thanks so much. Bye. Why do you .
Comments 0