[HN Gopher] Binance's Trust Wallet extension hacked; users lose $7M
___________________________________________________________________
Binance's Trust Wallet extension hacked; users lose $7M
Author : ilamont
Score : 71 points
Date : 2025-12-29 20:04 UTC (2 hours ago)
(HTM) web link (www.web3isgoinggreat.com)
(TXT) w3m dump (www.web3isgoinggreat.com)
| addams wrote:
| One of CZ's tweets hints at an insider threat, but Trust Wallet
| was one of the GitHub organizations pwned by Sha1 Hulud. What are
| the odds this is a fallout of that?
| gigatexal wrote:
| I can't have any more schadenfreude than I have now
| 3eb7988a1663 wrote:
| That is a great domain name.
| wyldfire wrote:
| I love the concept of cryptocoins. But in practice, there are
| some enormous hazards that make it not worthwhile IMO. This is
| just one such hazard, but by now we've seen several flavors of
| "this custody/storage mechanism failed to securely store some
| wealth." If securing it yourself, it's so easy to mishandle and
| either destroy your wealth or have it stolen. If delegating it to
| an "expert" you risk the custodial agent falling victim to
| theft/exit scam/ineptitude. Does any third party insure these
| agents?
|
| Having a government-insured bank deposit means that I've never
| had to think about this in my lifetime. It's a problem that I
| don't need.
| sunshine-o wrote:
| > Having a government-insured bank deposit means that I've
| never had to think about this in my lifetime. It's a problem
| that I don't need.
|
| Government-insured bank deposits are mostly BS, the fine prints
| say they have about 10 years to reimburse you and in case of a
| systemic failure good luck.
|
| In case the bank app, their "system" or your computer is
| compromised most banks will not reimburse you. It is very easy
| for them to say you were ultimately responsible for the hack.
| Very few banks have the policy of taking the loss and it is
| hard to know which one still do that unless you know someone in
| their fraud department.
| sunshine-o wrote:
| I believe the Achilles' heel of Web3 is really that is was built
| on Web1&2.
|
| Whatever opinion you might have about this industry, the core
| work is done by the Bitcoin and Ethereum teams and it is pretty
| admirable. They have been progressing for 10 years in a system
| where any mistake can collapse the entire system.
|
| But ultimately those wallets and Web3 apps are built with web
| technologies and run in a browser and this is just not made for
| this.
|
| This hack was targeting seed phases or private key because the
| keys have to be stored in the browser extension. How insane is
| that? But there isn't really any other ways to do it within the
| framework of a web browser.
|
| Ultimately if the extension or web app is compromised an hardware
| wallet cannot really ultimately protect you (at least you would
| only be compromised when interacting with it).
|
| Ethereum also now built in the secp256r1 signature checker so
| passkey/yubikey can be used but, same problem the "web" is the
| weak link.
|
| Bottom line if they want that thing to succeed they will have to
| create a way to interact with smart contracts outside of the web
| browser. Maybe it will take building a simpler "dapp browser".
| Their apps are pretty basic in the end, a TUI would be enough to
| swap a token and approve a transaction...
| Uptrenda wrote:
| But it has trust in the name. How can it be hacked?
___________________________________________________________________
(page generated 2025-12-29 23:00 UTC)