Warning to all lovers of CEXs.

[satscraper]

Another one bites the dust. This time GMX which was failed to withstand hackers. On 9th of July they managed to breach exchange security system and steal $42M.

GMX recommendations for users:

1) "Disable leverage: this can be done by setting Vault.setIsLeverageEnabled(false) or, if Vault Timelock is used, by setting Timelock.setShouldToggleIsLeverageEnabled(false)"
2) "Set all maxUsdgAmounts to "1" by using Vault.setTokenConfig or Timelock.setTokenConfig, to prevent GLP minting"


Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

[Charles-Tim]

Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

Very possible it is more like Hyperliquid. According to what I found out about the exchange, it is a decentralized exchange. I guess it is one of those Web3 exchanges.

Web3 was proposed to be decentralized, but all the platforms that are web3 that I have seen before, they are all centralized, including hyperliquid when I tested it.

Only what they offer is that you do not need to register and no KYC but with just your email, you can connect with the verification code sent to you or connect through any of those Web3 wallets or Wallet Connect.

They are all just centralized as long as you deposit money to their own addresses which you have no full control over.

[bias]

Another one bites the dust. This time GMX which was failed to withstand hackers. On 9th of July they managed to breach exchange security system and steal $42M.

GMX recommendations for users:

1) "Disable leverage: this can be done by setting Vault.setIsLeverageEnabled(false) or, if Vault Timelock is used, by setting Timelock.setShouldToggleIsLeverageEnabled(false)"
2) "Set all maxUsdgAmounts to "1" by using Vault.setTokenConfig or Timelock.setTokenConfig, to prevent GLP minting"

I think that this thread doesn't belong here. You are not talking about a trade or a trade service, so maybe it's better to move it to another section. Just saying...

Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

I don't believe that DEXs are safer from CEXs in terms of security breaches. I love DEXs since they don't have KYC and AML, but are slow in terms of trading since there are not many people using them. Even if CEXs have issues and checks of all kinds, people will not easily start trading on DEXs.

[Charles-Tim]

I don't believe that DEXs are safer from CEXs in terms of security breaches. I love DEXs since they don't have KYC and AML, but are slow in terms of trading since there are not many people using them. Even if CEXs have issues and checks of all kinds, people will not easily start trading on DEXs.

The fact is that on true decentralized exchanges, you can decide to use the address that you generate on your own noncustodial wallet to receive the coins. You can generate seeds phrase, private key and the address on the exchange but yet you can decide receive the coins at any noncustodial wallet address of your choice.

For derivative trading, I do not think there can be a decentralized exchange for it. Those that called themselves decentralized like this one are not actually decentralized but centralized.

[Frankolala]

A lot of web3 service are centralized and not decentralized because they are in charge of your funds and they also use a centralized server which makes it not decentralized. I feel there's no need to keep funds in any exchange. Have the mindset of transferring any idle funds into your self custody wallet where only you have the private keys. As long as bitcoin exist, scammers will always go after exchanges for a hack.

[Zaguru12]

Another one bites the dust. This time GMX which was failed to withstand hackers. On 9th of July they managed to breach exchange security system and steal $42M.

Yet again from GM , earlier this year there was an actually an exploit on abracadabra.money, another DeFi protocol integrated with GMX, and the lost amount was around $13M. This is yet again another warning that all this bridging and swapping protocols are simply not safe most especially since they usually requires ownership been added over to the platform. So as long as there is no decentralized system where you have full ownership of your assets, hackers will continue to exploits smart contracts.

In full context avoid wrapped coins too

For derivative trading, I do not think there can be a decentralized exchange for it. Those that called themselves decentralized like this one are not actually decentralized but centralized.

It will be hard to have decentralized derivative trading because of liquidity, the derivatives trading requires more liquidity on the platform or for the exchange to actual lock up some liquidity as collateral. A full scale derivative wouldn’t be able to achieve this because of the this done by centralized exchanges are simply just with users funds on left on the platform.

[dongiovanni]

Another one bites the dust. This time GMX which was failed to withstand hackers. On 9th of July they managed to breach exchange security system and steal $42M.

GMX recommendations for users:

1) "Disable leverage: this can be done by setting Vault.setIsLeverageEnabled(false) or, if Vault Timelock is used, by setting Timelock.setShouldToggleIsLeverageEnabled(false)"
2) "Set all maxUsdgAmounts to "1" by using Vault.setTokenConfig or Timelock.setTokenConfig, to prevent GLP minting"


Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

It’s honestly getting hard to ignore the pattern: another centralized exchange (CEX) falls victim to a major hack, this time GMX losing $42 million. No matter how many security measures are promised, the risks keep surfacing.

[Z-tight]

GMX developers have offered the hackers 10% of the stolen funds if they agree to return the stolen funds. If the hackers believe they can launder this money effectively, i doubt they will take the offer, but if they cannot, they may take the offer and receive a 'legal' 10% of the stolen funds.

GMX developers responded to the hacker, signing a message on-chain that read: "We want to offer a 10% white-hat bounty for the return of the exploited funds."

However, the hackers have been able to bridge almost $10m of the stolen funds into the Ethereum blockchain already, so they are acting fast and probably had everything already planned out.

[bias]

The fact is that on true decentralized exchanges, you can decide to use the address that you generate on your own noncustodial wallet to receive the coins. You can generate seeds phrase, private key and the address on the exchange but yet you can decide receive the coins at any noncustodial wallet address of your choice.

For derivative trading, I do not think there can be a decentralized exchange for it. Those that called themselves decentralized like this one are not actually decentralized but centralized.

Yes, I know that DEXs allow you to put your address and work like this and to be honest, is the best and true crypto way. But for trading in constant mode/ day by day, they need volume, thus people. And most of them are focus on CEXs. It's very difficult to change their way of thinking and make them go on a DEX and start trading there. However, I believe that now that all the CEXs want more and more KYC, people will realize that the only way are DEXs.

[albon]

GMX developers have offered the hackers 10% of the stolen funds if they agree to return the stolen funds. If the hackers believe they can launder this money effectively, i doubt they will take the offer, but if they cannot, they may take the offer and receive a 'legal' 10% of the stolen funds.

I don't think hackers will accept 10% of the stolen funds because  still be tracked down or caught afterward.. That’s why I believe they’ll try to launder all the funds instead. $42 million is honestly a huge amount.

We must know that CEX and DEX  can be hacked and exploited. Indeed, DEX is more secure in terms of privacy,, but this does not prevent hackers from bypassing the platforms' security and exploiting their vulnerabilities to steal funds.

We must also know that smart contracts themselves are vulnerable to attacks, so it is necessary not to completely trust DEX. It is better to use a more popular decentralized exchange in the market and has no history of major hacks.

Also, users' funds should be in their own custody,, and they should be the primary controller of them, without leaving them locked inside smart contracts.

[Lucius]

~snip~
Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

For most people, nothing other than CEXs is an option - because they are looking for simplicity and liquidity, which is often not the case with DEXs. Try to explain to the average person the advantages that Bitcoin has over fiat, and most will tell you that they don't see any advantages in it.

As for the hacking of CEXs, I think that, except for the few largest ones, all the smaller ones do not invest enough in the security of their platforms, but they obviously have no problem offering hackers millions of dollars to return some of their coins. Obviously the rule "prevention is better than cure" does not apply to them.

[Z-tight]

GMX developers have offered the hackers 10% of the stolen funds if they agree to return the stolen funds. If the hackers believe they can launder this money effectively, i doubt they will take the offer, but if they cannot, they may take the offer and receive a 'legal' 10% of the stolen funds.

I don't think hackers will accept 10% of the stolen funds because  still be tracked down or caught afterward..

Nope, i don't think so, if the hackers accept the 10% white-hat bounty to return the stolen funds, the service wouldn't spend any extra resources tracking them down anymore, the case will be as good as dead. Exchanges make this offer a lot to hackers after they have breached their system and stolen from them, but hackers rarely accept this because they must have already planned how to launder the stolen funds, so they'll slowly do that.

[Trêvoid]

GMX developers have offered the hackers 10% of the stolen funds if they agree to return the stolen funds. If the hackers believe they can launder this money effectively, i doubt they will take the offer, but if they cannot, they may take the offer and receive a 'legal' 10% of the stolen funds.

I don't think hackers will accept 10% of the stolen funds because  still be tracked down or caught afterward..

Nope, i don't think so, if the hackers accept the 10% white-hat bounty to return the stolen funds, the service wouldn't spend any extra resources tracking them down anymore, the case will be as good as dead. Exchanges make this offer a lot to hackers after they have breached their system and stolen from them, but hackers rarely accept this because they must have already planned how to launder the stolen funds, so they'll slowly do that.

hackers can still face legal consequences if identified, as seen in other cases like Mango Markets, where a hacker who returned stolen funds was later convicted

https://therecord.media/hacker-returns-stolen-gmx-bounty

[Z-tight]

hackers can still face legal consequences if identified, as seen in other cases like Mango Markets, where a hacker who returned stolen funds was later convicted

https://therecord.media/hacker-returns-stolen-gmx-bounty

Oh, i see, i thought accepting the white-hat bounty and a promise from the service not to pursue legal action meant the case was as good as dead, but Avraham Eisenberg, the hacker who stole from Mango Markets was arrested and convicted, despite reaching an agreement with the platform.

However, good news for GMX as the hacker has returned the stolen funds in exchange for a bounty of $5m, so it is safe to say that if the hacker manages to go unidentified, then they can spend the funds freely, or else they could still be arrested. My final thought is that if many hackers are still tracked down and arrested after agreeing to a white-hat bounty, then in the future, none will reach such an agreement and instead take the risk of laundering the money.

[Hyphen(-)]

Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

Some new users finds the use of Centralized exchanges easier to the extent of leavening their savings in there, they don’t even care about their privacy anymore because they don’t think the exchange can be hacked at any moment, some of them don’t know the value of this phrase “not your keys, not your coin”, they tends to believe in centralized exchanges about the security of both their funds and their personal data submitted during KYC.
Now that the SEC is bringing different charges and some rules to CEXs, the exchanges will also impose some rules to their customers which are all against privacy. The best thing is to use DEXs for your normal trading and then user your personal wallets to save your Bitcoin.

[Potato Chips]

Oh, i see, i thought accepting the white-hat bounty and a promise from the service not to pursue legal action meant the case was as good as dead, but Avraham Eisenberg, the hacker who stole from Mango Markets was arrested and convicted, despite reaching an agreement with the platform.

That's what I thought too. And now I'm wondering if some of these hackers perhaps had the same misunderstanding at some point lol. Imagine thinking you're untouchable and then BOOM.

So there aren't much benefit from negotiating with victims and coming to a settlement? since any other law enforcement could still pursue you if they want to? or are there other stuff?

[Z-tight]

So there aren't much benefit from negotiating with victims and coming to a settlement? since any other law enforcement could still pursue you if they want to? or are there other stuff?

Yeah, as i just found out too, there's really no benefit. If i was a hacker (which i am obviously not), and i see others who agreed to the white-hat bounty, but are still spending time in jail, i surely would not reach any agreement after any successful hack.

Services that may be hacked in the future may not get lucky to strike a white-hat bounty deal, or better still, they should invest a lot of money into their security, so they don't get hacked.

[EarnOnVictor]

Isn't the better to use DEXs instead of CEXs? The answer seems to be obvious.

In terms of the right of ownership of your funds, DEX is the way to go, but when it comes to the overall experience, CEX is the way to go, which is why people are choosing CEX, especially for trading and business transactions. So, people will never stop using CEX, no matter what you tell them.

However, they are more at fault as they increased the risk by going for lower-ranked exchanges. Bigger exchanges will be able to absorb unforeseen circumstances like this, but smaller ones may not.

[bias]

Yeah, as i just found out too, there's really no benefit. If i was a hacker (which i am obviously not), and i see others who agreed to the white-hat bounty, but are still spending time in jail, i surely would not reach any agreement after any successful hack.

Maybe it seems like the hackers don't have any benefit, but they do. Firstly, because the money that they will get from the bounty is crystal clear thus it can be used everywhere, and secondly, because it's more than certain that some government or company will hit their jail door or even get them out of there in no time for working for them. The thing is, if a hacker wants something like that. From "black-hat" to "white-hat".

[joniboini]

Honestly, I've never seen someone call themselves a CEX lover. I have a feeling that they'll move to another platform if it's convenient, they just don't accept the tradeoff that usually comes with a DEX or P2P. Some would argue that even DEX isn't free from malicious attacks, although CEXs are the bigger fish to try because there could be many security concerns with their operation.

We can only remind the average joe to never "trust" an exchange or any service to the point where they leave their money at their mercy for long.