Hacker News

So USDT is a great amazing decentralized censorship-free drop in replacement to USD except:

- much more awkward to use

- more liable to hacks

- deposits are not insured

- fewer legal protections

- doesn’t pay interest (or not easily anyway)

- and as I find out, bannable by a central institution with lower legal oversight than the Fed

I’ll keep a mental note of this.

Turns out that there are quite good reasons to have a centralised currency after all. Who would’ve known.

Arguably any fiat-collateralised stablecoin is ipso facto centralised and trusted (someone needs to 1) issue the coins only against fiat collateral and then 2) hold onto that collateral reliably and 3) return it upon presentation of the coin), and at step 3 they can always say "no, we won't give it to you".

Decentralized is a great concept but it’s 99.9% rug pulls and you can’t get any safety unless you centralize. As an investor there is no way to protect yourself because the rug pulls are several orders of magnitude more sophisticated than most people’s understanding.

The U.S. government is the largest beneficiary of this service. More than $2.1 billion in USDT connected to or requested by U.S. authorities out of over $4.4 billion in total illicit USDT freezes globally.

Anyone can refuse any bitcoin, too. But that's not implemented in the contract, just by how much real money people want to give you for bitcoin.

The financial system has evolved over 5000+ years and is like an endless series of Chesterton's Fences at this point. Here we find another: the ability for a regulator or a bank to freeze assets is once again proven to be a feature not a bug.

Managing a wallet where there is no recourse if your wallet is compromised is simply too difficult when even crypto exchanges get hacked and otherwise sophisticated people get compromised when taking cautious measures (eg [1]).

Crypto really is and always was a race to the rug pull.

[1]: https://www.straitstimes.com/singapore/about-3-5-million-los...

A shame that they can and do so here but happily facilitate transfers or scam victims, human trafficking and sexual abuse including of minors.

So when tether is blacklisted, is it reissued?

> waste of time

It seems like it took some number of minutes and scored billions, and at that point it was a matter of whether/how much they could trade out before it was locked. I don’t know how many minutes or hours it took to lock? If they managed to trade 1% before blocking, that would be an extra tens of millions. If 10% that would be hundreds of millions, etc.

Apparently [1], he managed to put them as collateral on a lending platform. That allowed him to borrow ETH. The way it works is that if you don't pay back the loaned ETH, the lenders can take the collateral. Except that here the collateral is itself frozen. So apparently, the ETH as now safe in the hacker's wallet and the lenders just lost a bunch of money.

I wonder why not swap them? And had he, would it have bricked the swap pool?

[1] https://x.com/czesmaill/status/2115988477905080716

In this case it looks like the attacker managed to swap some stablecoins into ETH before they were frozen.

It reveals what they are to the public. It's fake crypto with all the downsides of crypto but none of the upsides.

Poor fellas, barely enough for rent

Centralized stablecoins like USDT and USDC aren't layer-one cryptocurrencies like Bitcoin or Ethereum. They're more like applications running on top of other blockchains, usually as smart contracts, and their issuers hold admin keys which can freeze, mint, burn, and otherwise redistribute funds at will. As far as timing goes, stablecoin issuers can't actually cancel or reverse a transaction that's already in a block that's been mined, but they can freeze the receiving address afterward and burn the funds there, then reissue them elsewhere, which has much the same effect.

Stable coins are not decentralized

Stablecoins only use the accoutrement of blockchain as smoke and mirrors to distract and confuse regulators, not because they actually benefit from it at a technical level. They aren't really decentralized at all and could just as easily be a database, except for the regulatory thing

nothing about crypto is decentralized. it's verified by enormous mining farms, who contribute hashes to centralized pools, all stored on one central ledger, and interfaces with the fiat/legit financial system only by using that very financial system.

oh, and three acounts hold like 25% of all btc in circulation.

crypto can do some things, but decentralization isn't one of them. just ask Coinbase

USD tether is barely crypto at all, it's a wrapper around treasury bonds which the US govt. regulates

It doesn't, the hacker already loaned against it to get eth so they froze saves assets.

The smart contract for those tokens supports freezing. Tether just calls the freeze function on that address.

Most crypto assets are operated by a smart contract that controls every transfer. So the contract can decide to not perform certain transfers.

If people dont know, they should look up DAO hack and Ethereum hard fork.

USDT and USDC are both centralised crypto currencies with a single source of truth.

Does anyone on this website realize there are different types of crypto coins?

USDT is implemented as a contract written in Solidity, working over other network like ETH, and it has a blacklist managed by admins. Once address is added to a blacklist, you cannot spend anything from it.

yeah bitcoin indeed was

That's not the whole point at all. And there are truly wild west cryptos, but most people want some trustworthy regulatory body, whether it's a government or not, backstopping their funds when they get large enough.

For instance to unwind a 5 billion dollar robbery

Stablecoins are fiat on-chain and they are legal so they need to have the freezing mechanism in the smart contract otherwise they could go to jail.

So crypto + legal company means not really following bitcoin ideology anymore

At least a motivated person could audit the smart contracts on this. It isn't like it's a surprise when it turns out it's possible to freeze these coins.

this isn't crypto, it's US dollars with a techno-wizard sheen on the top for no reason

It's so sad that it's inconvenient for you to commit fraud and tax evasion and pyramid schemes and rug pulls.

My heart goes out to you, along with these two definitely not Nazi salutes.

governments, banks freeze currency all the time

> Freezing crypto is so disgusting to me I don’t know…

The feature literally appears to have just saved over two billion USD from being stolen! I mean, fine, "disgusting" is subjective. But the need for the feature is real and quantifiable (and very large) and it did what it advertised.

[dead]

Well it is engineers fault. But not that engineers. Some engineer designed a system without extreme oversight that should be involved in the process.

If nothing else it shows a complete disregard for insider threat.

Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.

But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".

If you download a typosquatted package because you don't check what you type or your AI assistant got fooled I'd consider it my fault in such a case.

I have been using Yubikeys for years, according to this guide: https://github.com/drduh/yubikey-guide

The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.

These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.

How would that help when your workstation is compromised? They can just steal your authentication the moment you log in through the password manager

as for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.

you know most password managers have open sockets, or other channels to other local processes to interact with and allow stealing entries?

you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?

Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently

Isn’t the password manager a prime target too?

They claim the attack wasn't just "compromised laptop ==> drain wallets" but had more steps in-between, with the attackers using image registries as an entry point into their systems.

Read a few, added to my rss reader :) that's the same author as https://www.web3isgoinggreat.com/ which is feels a bit more snarky but very fun.

>The problem with Bitcoin being on your computer is that its useless there.

If you want to use the BC on your computer, you can transfer it to wherever you want.

we will see if they do.

> It seems better when it's on an exchange like Binance, because they cover you when it gets stolen.

Assuming they actually can cover the losses financially.

And if they don't good luck suing them.

Don’t think they’re suggesting it’s not a big deal.

Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.

That said yes the trading volume has huge.

It is a big deal, but not big enough for them to go out of business

From what I've read, DebugBear is related to the Polymarket hack, not Binance.

The problem is, just like with Bitcoin, when you need to use it someone could steal it

TRM Labs[0] claims it is indeed NK

[0]: https://www.trmlabs.com/resources/blog/north-korea-steals-us...

What would be the list? NK, then Russia, anybody else ?

Crypto is a hard lesson for early adopters who believed that humanity will get actual benefit when in reality it was completely hijacked by bad actors while people got relative nothing or worse. What an incredible disappointment of a project.

why would it pop tether? if anything, it makes tether more profitable, as they can collect the yield on the treasuries and not have to return the principal dollars which are frozen.

think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.

[dead]

[flagged]

The lession learned is: Tether now exists as a casino chip central bank. They can just freeze and print more and provide a backstop to the major CEXs.

Of course, Tether runs completely counter to any of the idealistic claims about crypto.

The difference is that Bittance loses only a few percent of their reserves and the dance continues. Gdox did ~70% of the daily volume for crypto and wrecked the entire ecosystem when they got 100% pwned. Maybe they've learned something!

Mt Gox was widely reckoned to be a clown show long before they got hacked (it was originally a Magic the Gathering trading site for chrissake).

Binance's reputation is hardly impeccable, but by crypto standards they're kinda sorta the adults in the room. Then again, so was FTX.

How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).

A bank API can be 10-100s+ kloc if they need that to implement access controls.

Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.

People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.

There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.

What's the supposed lesson? To close the shop?

To put things in perspective, I used to dunk on crypto because of how dysfunctional and how people kept losing money in scams, hacks, or even by accident.

I no longer dunk on crypto.

Not because crypto got better, but because the joke got old. I got tired of dunking on it.

The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of funds on some wallet to support day trading.

For a large CEX like Binance, $5B might just qualify as a hot wallet.

You see, he's no longer running Binance or participating in its operation in any capacity, per their deal with the Trump admin / Justice department. He's tweeting about this hack as a civilian, offering personal guarantees to Binance customers out of the goodness of his heart!

Measuring the size of the heist in USD is convenient but arbitrary, as what was stolen was predominantly Stablecoins, BTC and ETH. So it makes more sense to measure the heist in Stablecoins, BTC and ETH. But that doesn't create as exciting a headline, as the BTC component was almost 50x smaller than the Mt. Gox heist!

tell me how NK woould steal 6B, or any money, with a virtual hack, from a bank. not by going in there guns blazing.

How do/did they get it out though?

You cannot mix billions in TC

Wrench attack

https://nypost.com/2025/11/25/us-news/sam-altmans-ex-boyfrie...

yea, break things... like your legs

Not necessarily. But I believe they said that the laptop was hacked.

Billions at stake in a service that is highly used to launder money, exchange illegal goods, etc.

Whoever went for this has some balls.

what kind of regulations would serve this particular scenario?

The hack is purely technical in nature.

This could have been the FED's system that got compromised and the response would have been the same.

Oh, no, sorry - it wouldn't because we wouldn't even know it happened as FED is fully opaque while crypto is quite transparent.

In that sense crypto is much more democratic because at least there's some ability for the public to audit it. With FED there's none.

You could prompt it to do the opposite.

that would be a net loss - it's as if you postulated to not rebuild the Internet after the countless breaches and hacks.

these use cases exist with all forms of cash too

not to be whatabout... but... anything of value is used for all that too, in much larger amounts.

it is wild to me that people expect that crypto is supposed to solve a problem that is as old as currency.

Bitcoin was meant to be cash and an antidote to crony finance. Instead, it became yet another mechanism for the financial world to abuse. I'd say thats a pretty heavy failure by any measure.

For me bitcoin opened up the idea that we could maybe do money better. That idea still lives, but not in practice. Yet.

NFT era was the peak of stupidity. I lost a lot of respect for many “smart” people during that time.

how are you gonna use your paper keys when you want to spend some of your bitcoin? the private key has to touch a computer at some point.

Security through decentralization, if there is such a term.

I'm not concerned because I have zero crypto because I would hate to be worried about being hacked to have it stolen.

Yeah apparently it's news in 2026 that banks can actually keep their assets secure in comparison to the web3 clown fiesta. Of course banks do get compromised but not anywhere close to this degree.

Honey can be exchanged for goods and services

Perhaps OP means to say it is a honeypot criminals create for us ...

I know, but if something is split up and stored in a vault somewhere the likely hood of a vulnerability napping the wallet falls. Defence in depth and risk analysis.

I don't know much about bitcoin but surely you don't store this all in one wallet? You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe?

I'd be really curious to know what their security architecture was.

that one was over (years?) time, wouldn't call that a heist really

fraud, not a heist

Guess they said by(e) to their bit(coin)

"have anything to do with the company anymore", lmao what crucial decisions would even be in play here that Richard Teng wouldn't obviously make?

And lots of museum-quality art. And a few oligarch condos.

Pretty sure you can get a metaverse for dirt cheap these days. Still, no one has figured out why you'd want one.

You must be joking. With $5.6 billion you could lose 80% and still have over $1 billion.

Only down 3% today, which is pretty much nothing for something that regularly sees 20% swings

This is what I do. I'll only use crypto in a few rare cases where I don't want the vendor to get my credit card number. Always in amounts that, if ever stolen, would not break the bank.

I suppose they could play the super long game and deposit many many small amounts into "shady" online crypto casinos, play a few hands of blackjack and then withdraw. Clean coins.

https://xxcancel.com/cz_binance/status/2115915423174853077

"Pardoned" with implications of bribery, as opposed to being found innocent by a court.

Dead internet

Came back here to see if i was seeing double

> And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself

Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.

This might sound good.. but freezing currencies is bad. It evaporates trust of liquidity from whoever is doing governance. It's part of the reason why the bond market is doing what its doing lately and why countries are on-shoring gold reserves.

they borrowed ETH against the stablecoins on AAVE before they were frozen

Doesn't matter how much they custody!

Uh don’t you not want to cover losses with customer funds?

Another guy pardoned by Trump.[1]

[1] https://people.com/trump-pardons-changpeng-zhao-binance-cryp...

> Funds are safe

https://www.youtube.com/watch?v=DelF6zEHXpE

Fractional reserve banking but for Bitcoin.

It's a (weak) bear market capitulation signal - max fear when people think everything is broken.

already over. a tiny bounce after falling 55%

You mean FTX?

much more was at risk as a percentage of market size, market was in worse shape,

Though in that case the crash was directly due to "effectively altruist" SBF fraudulently dumping customer assets in a half-brained and presumably stimulant-addled attempt to manipulate the market and reduce his liabilities.

Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.

Not to be too pedantic, but with some napkin math, I don't think this is true. Looking for clarification!!

I downloaded Binance's self published market data (https://data.binance.vision/), calculated spot and futures volume for the past year, and then applied their *highest fee tier* on both sides of the volume (for every $1 traded, they generate a fee on the taker and the maker. the fee rate is asymmetrical).

Spot revenue worked out to $7.6B USD, perps revenue worked out to $13.8B

This is an upper bound on the fees charged on volume. Binance also scams their users with a b-book, has DMM deals, etc.

I don't want to get into all that today.

But the final result is that they print somewhere in the range of $20B per year on fees. I guess CZ also has huge stockpiles of BTC and stuff. A 1% rise in BTC price probably means more for them than their actual fees, LOL.

All this to say, I think $5.6B significantly hurts.

See Google's stock price today. Their ads business slowed down a bit, and their stock tanked 10%. If binance was publicly traded, I imagine a similar affect would be demonstrated on their price.

How much money do you think they are making? Because I really doubt this is peanuts to them.

Well at some point they were.

I don't think the security trade-off for most people is clear here.

Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.

I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.

[1] https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088...

So what happened with all of those with hardware wallets that have been pwned?

There apparently is no such thing as “your crypto” with how many security problems there are.

Code is law!

This is highly insensitive and highly logical. I am very conflicted.

not your keys not your coins...

If someone steals your wallet, it wasn't your money, just the free market working as intended.

Controlling your own crypto keys is like having your net worth in cash or gold stored in your house. It could easily be lost or stolen or destroyed in a fire unless you take extraordinary precautions and then it is all gone.

Holding assets in USD isn't the same as paying taxes.

Someone is certain to buy dirty coins at the right price point.

they aim for four nines nowadays.

Hope it's not stored in a Ledger wallet...

It's worth still dropped by 5% though and counting.

So 3% yearly Inflation? The target is 2% so not too bad. You don’t want your actual currency to gain value just by waiting.

Sure, but you could also have used this dollar to buy oil, gold, stocks, bonds etc

BTC has ~26% less purchasing power than it had at the beginning of 2026. I’m not sure its volatility is a win.

>$1 in 2008 is worth $1.56 today

That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.

Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.

The US dollar is worth less than it was in part because the US economy has grown.

This is mathematically provable:

1. A dollar in 2008 could buy 1/14tn of the value created by the US economy (the GDP) in 2008.

2. A dollar today can only buy 1/32tn of the value created by the economy in 2025.

It's obvious a 2025-2026 dollar is worth less than a 2008 dollar. That's just math.

But. A dollar in 2008 could buy 230% more of the economy than it can today. And you say its purchasing power has only eroded 64%. That means the dollar is actually worth more today, compared to the size of the economy it's in. Weird, I know.

EDIT: I'm fine with downvotes but tell me why I'm wrong.