Altman Talks About OpenAI's New Model Cracking Math Problems After Drinking

Holy crap, this really demands a holy crap — Binance's hot wallet was completely looted, and their own system actually proactively deposited 200 million straight into the hacker's address! Even more absurd, 3.3 billion was swept clean in 4 minutes! Even when He Yi tweeted to suspend withdrawals, the hacker was still frantically withdrawing coins in the background... I made a video fully explaining the whole process, It can be called the largest coin theft incident in Binance's history — the hot wallet was completely looted, and their own system actually proactively deposited 200 million straight into the hacker's address! The on-chain records of Binance's main hot wallet having $3.3 billion in assets swept away in the early morning have all been dug up. What makes one's blood run coldest is not at all how large the amount was, but that the hacker had long since thoroughly understood the system's signing mechanism. From the hacker launching the attack on-chain at 4:20 a.m. to the main wallet being comprehensively looted, the entire on-chain trail exposes that the core signing system may have long been compromised. Everyone assumes by default that when an exchange is hacked, it's either the front end being phished to swap addresses, or an insider absconding with the funds. But the operations reconstructed on-chain this time are essentially a dimensional-downgrade harvest targeting Ethereum's new protocol EIP-7702. The hacker attached a proxy delegation to the main hot wallet that had sent tens of millions of transactions. Once the delegation took effect, the contract could freely dispatch assets in the wallet's name, and in four minutes the first wave of $2.5 billion went straight to zero. Even more fatal was the lag in the automated process. After the main wallet was emptied, the automatic collection script was still running mechanically, and even another hot wallet proactively topped it up with 200 million USDT after 5 a.m., only to be intercepted by the hacker at light speed 72 seconds later. In the most critical attack transaction at 4:20, 50 authorizations bearing the hot wallet's legitimate private key signatures were packaged all at once, which shows the hacker had long held a complete set of legitimate signatures. Stay clear-headed: although stablecoins can be directly blacklisted and frozen through centralized means, the nearly 200,000 ETH lying in the hacker's address is not subject to control by any institution at all, and on-chain recovery is extremely difficult. The most fatal vulnerability is never a typo written into the code, but that your proud automated defense system still blindly trusts a signature seal that has already been captured by the enemy.

View original

卧槽，这个真的必须卧槽一下了，币安热钱包被洗劫一空，他们自己的系统，居然主动给黑客的地址硬生生充了 2 个亿进去！ 更离谱的是，4 分钟扫光 33 个亿！甚至何一在发推暂停提现的时候，黑客还在后台疯狂提币…… 我做了个视频完整讲解整个过程， 堪称币安史上最大的盗币事件了，热钱包被洗劫一空，他们自己的系统，居然主动给黑客的地址硬生生充了 2 个亿进去！ 币安主力热钱包在凌晨被卷走 33 亿美元资产的链上记录全翻出来了，最让人后背发凉的根本不是金额有多大，而是黑客早已摸透了系统的签名机制， 从凌晨 4 点 20 分黑客在链上发起攻击，到主力钱包被全面洗劫，整个链上痕迹暴露出核心签名体系可能早就被渗透了。 大家默认以为交易所被黑客攻击，要么是前端被钓鱼换了地址，要么是内鬼卷款跑路。 但这次链上还原出来的操作，本质上是一场针对以太坊新协议 EIP-7702 的降维收割。 黑客给发送过上千万笔交易的主力热钱包挂上了代理委托，委托一生效，合约就能以钱包的名义随意调度资产，四分钟内第一波 25 亿美元直接归零。 更致命的是自动化流程的滞后，主力钱包被清空后，自动归集脚本依然在机械运转，甚至另一个热钱包还在凌晨 5 点多主动往里面补了 2 亿 USDT，结果 72 秒后就被黑客光速截胡。 4 点 20 分那笔最关键的攻击交易里，一次性打包了 50 个带有热钱包合法私钥签名的授权，这说明黑客手里早就握有成套的合法签名。 留个清醒，虽然稳定币可以通过中心化手段直接拉黑冻结，但黑客地址里趴着的近 20 万个 ETH 根本不受任何机构管控，链上追回难度极高。 最致命的漏洞从来不是代码里多写了一个错别字，而是你引以为傲的自动化防御体系，还在盲目相信一个已经被敌人拿下的签名印章。