Bitget Hack, Duelbits, ColdCard, Haruko, Liquid - Time to change?

[Italian Panic]

In the last few hours, hacks have taken place at the Duelbits online casino and the Bitget exchange, on two different scales: the first for 7 milion dollars and the second for the staggering sum of 351 million dollars.

In the past weeks was time for: Coldacard, Haruko, Liquid and much more. Many of these are linked to attacks involving AI agents; over the past 19 months, a total of 3.63 billion dollars has been stolen from the crypto ecosystem, and with today’s Bitget hack, the total has surpassed 4 billion.

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

(Thanks to oll) Bitget hack: https://bitcointalk.org/index.php?topic=5595028.msg67177125#msg67177125

[oll]

It appears that, in the last few minutes, there has been an incident involving a hot wallet on the Bitget exchange, and around 170 million dollars have been stolen. The latest reports suggest the figure may be even higher; this is certainly a significant blow for the exchange.

Sorry, but similar topic is already created:
https://bitcointalk.org/index.php?topic=5595020.msg67176830#msg67176830

[EluguHcman]

It appears that, in the last few minutes, there has been an incident involving a hot wallet on the Bitget exchange, and around 170 million dollars have been stolen. The latest reports suggest the figure may be even higher; this is certainly a significant blow for the exchange.

I can only imagine that this news can be true because, hot wallets being connected to online has it vulnerable risks for the platforms server to be hackable.
Even you as the user of the platform, your private keys are still stored online and controlled by the same authorities whose security server is weak enough to be hacked. Else. I expected this discussion to be backed with link to source of the information and then, we can strictly talk about the event the exchange itself .

Bitget I know is one of the most wide used exchange and had just shown itself of how vulnerable the hot wallets could be.
If hackers don't have you particularly on targets, they can pass the server to get necessary datas of you that can lead them access to your address or privacy just to steal tiu funds.

[hugeblack]

I fear such attacks could lead to the abandonment of privacy and a crackdown on any service that makes tracking currencies more difficult; ultimately, users tend to be complacent, and regulators will view this as a golden opportunity to shut down decentralized systems and mandate widespread KYC compliance.

[Italian Panic]

It appears that the attackers did not compromise any private keys, but rather compromised a third party tool that had access to a backend with high level permissions. Thanks to this access, they forged Bitget’s internal documentation and used digital signatures recognised as valid by Bitget’s internal systems, thereby ordering fund transfers.
The attackers proved to be very clever, as they stole various types of funds and sent them to multiple blockchains simultaneously, effectively slowing down Bitget’s defence system, which would have had to act on several blockchains at the same time.

[OcTradism]

In the past weeks was time for: Coldacard, Haruko, Liquid and much more. Many of these are linked to attacks involving AI agents; over the past 19 months, a total of 3.63 billion dollars has been stolen from the crypto ecosystem, and with today’s Bitget hack, the total has surpassed 4 billion.

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

It's time for change.

This alarm from Jameson Lopp after Coldcard hack.
The rise of machines (AIs).

If you don't know.
OpenAI Agent Hacked Australian Government Medicare Portal in World’s First Rogue AI Breach.

It's truly time for change, for individuals, companies, institutions to governments.

[KiaKia]

In the last few hours, hacks have taken place at the Duelbits online casino and the Bitget exchange, on two different scales: the first for 7 milion dollars and the second for the staggering sum of 351 million dollars.

In the past weeks was time for: Coldacard, Haruko, Liquid and much more. Many of these are linked to attacks involving AI agents; over the past 19 months, a total of 3.63 billion dollars has been stolen from the crypto ecosystem, and with today’s Bitget hack, the total has surpassed 4 billion.

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

(Thanks to oll) Bitget hack: https://bitcointalk.org/index.php?topic=5595028.msg67177125#msg67177125

AI agents are going to keep creating more problems than solution and that's because people would prefer to be scammers than solution finders this days, I think the law on fraudsters and scammers aren't tough enough.

They need to make an example out of people who are caught in hacking and scamming, they need to go hard on them or else people will start to consider becoming a scammer than going to school.

This year is going to be a year to remember, we have few months left and yet series of hacks and theft keeps happening like it's everyday normal thing, there is nothing more scary right now than this.

[IjawMan]

AI agents are going to keep creating more problems than solution and that's because people would prefer to be scammers than solution finders this days, I think the law on fraudsters and scammers aren't tough enough.

Is the AI agents a tool accessible to scammers and hackers alone that these companies can not also use it as defensive mechanism in testing and improving their security wall?

Let ask the real question; is the growth of AI agents the core cause of this or it is about a third party access tool failure. An inter-chain permission failure is what am looking at.

This year is going to be a year to remember, we have few months left and yet series of hacks and theft keeps happening like it's everyday normal thing, there is nothing more scary right now than this.

The year of crypto code exploit hacks.

[Spaceman1000$]

It appears that, in the last few minutes, there has been an incident involving a hot wallet on the Bitget exchange, and around 170 million dollars have been stolen. The latest reports suggest the figure may be even higher; this is certainly a significant blow for the exchange.

I can only imagine that this news can be true because, hot wallets being connected to online has it vulnerable risks for the platforms server to be hackable.
Even you as the user of the platform, your private keys are still stored online and controlled by the same authorities whose security server is weak enough to be hacked. Else. I expected this discussion to be backed with link to source of the information and then, we can strictly talk about the event the exchange itself .

Bitget I know is one of the most wide used exchange and had just shown itself of how vulnerable the hot wallets could be.
If hackers don't have you particularly on targets, they can pass the server to get necessary datas of you that can lead them access to your address or privacy just to steal tiu funds.

I should expect that Bitget haven been in the crypto space for this long should be able to have enough firewall in their backend protection, issues concerning hack in a tone of millions of dollars isn't a joke, except their is an in-house compromise. CEXs are increasingly looking suspicious with some of this incident, today the blame is on IA agents, tomorrow it will be on something else, of course I understand hackers are increasingly looking for means to steal, but then why will the CEXs be victims a lot of times, these are companies people have invested lots of their resources in, such news could increase someone's Blood pressure, the CEXs should do more in protecting their assets.

[rbynxx]

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

It's all has been said and done, but we still get some of these hacks going around like it was an everyday thing. If the recent hacks was about a hot wallet compromised, isn't it simple that the one controlling the private key or sign in access has the reason to make it secure as ever or if it's multisig, what are other avenues? I don't think Duelbits and Bitget aren't aware to these protocols but still they got compromised. So what's the best solution then? Go offline, but make it all airgapped?

[Lucius]

~snip~
Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

If you keep your funds online at all times, you are exposed to great risk - so the first thing everyone should do is try to be their own bank. Of course, this is not easy and some will say that even then there are risks, but non-custodial, open source and air-gapped wallets are something everyone should strive for.

When it comes to privacy and anonymity, you know best how the most popular OS spies on its users, so the first step is to change the OS (Windows -> Linux), and only then does it make sense to use Tor or VPN.

[Don Pedro Dinero]

I see that the OP was originally going to discuss the Bidget hack, but after it was pointed out that there was already another thread on the subject, they’ve shifted the focus to the various hacks that have taken place and online security.

It's all has been said and done, but we still get some of these hacks going around like it was an everyday thing. If the recent hacks was about a hot wallet compromised, isn't it simple that the one controlling the private key or sign in access has the reason to make it secure as ever or if it's multisig, what are other avenues? I don't think Duelbits and Bitget aren't aware to these protocols but still they got compromised. So what's the best solution then? Go offline, but make it all airgapped?

For businesses, I imagine it will become standard practice to take out insurance against this sort of potential hack, as well as improving security as much as possible and managing their finances wisely, keeping substantial reserves in cold wallets.

At an individual level, this comes on top of all the wrench attacks that have taken place, which mean we need to be more cautious than ever.

[lionheart78]

Online account hacks had always been an issue for years. The way I look at these events,  the hackers are getting smarter each day, taking advantage of the technological improvement, while security has been lagging because most of them are too conservative, believing that if the wheel is not broken, there is no need to fix it.

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

Does this solve the problem?  As a user, all we can do is to never leave our funds on centralized exchanges, or online financial institutions that hold our funds, and learn how to lay out security to our devices and safeguard our own holdings.

At an individual level, this comes on top of all the wrench attacks that have taken place, which mean we need to be more cautious than ever.

Yeah, aside from not flaunting our wealth online, we must keep quiet and stay low profile at all time.  We never know whether there is someone in our neighborhood who has wicked minds.

[hd49728]

I fear such attacks could lead to the abandonment of privacy and a crackdown on any service that makes tracking currencies more difficult; ultimately, users tend to be complacent, and regulators will view this as a golden opportunity to shut down decentralized systems and mandate widespread KYC compliance.

Governments can borrow many reasons to enforce their AML and KYC policy but did they already do these things with banks while there is still money laundering through bank system globally?

I agree with you that hacks in blockchain and cryptocurrency market industry will give governments perfect opportunities for tighten their AML and KYC enforcement on centralized exchanges, even try to KYC non custodial wallets but I don't know how far and how much achievement they can do with that.

KYC and AML are dangerous and useless, and this fact is not new.
Recent events should make everyone withdraw all their coins to their own wallets: Part 1; Part 2; Part 3
and Part 4.

[Sim_card]

It's a pity that no one funds is safe even if stored in a cold wallet if you don't add extra security because I believe that coldcard is a cold wallet and was still compromise. I read that some part of the funds that was hacked from Bitget was from their cold storage. I don't know why these many hacks at this time during the bear market or is this how it normally happen during the bear market? However, it's good to fully go on a hardware wallet and add a strong passphrase to your seed phrase to ensure the safety of your funds or better still multisig wallet. Exchanges should also use multisig for their wallets.

[rbynxx]

It's all has been said and done, but we still get some of these hacks going around like it was an everyday thing. If the recent hacks was about a hot wallet compromised, isn't it simple that the one controlling the private key or sign in access has the reason to make it secure as ever or if it's multisig, what are other avenues? I don't think Duelbits and Bitget aren't aware to these protocols but still they got compromised. So what's the best solution then? Go offline, but make it all airgapped?

For businesses, I imagine it will become standard practice to take out insurance against this sort of potential hack, as well as improving security as much as possible and managing their finances wisely, keeping substantial reserves in cold wallets.

At an individual level, this comes on top of all the wrench attacks that have taken place, which mean we need to be more cautious than ever.

Moreover, insurances aren't the all-in-one solution, the problem still exist and that should be the focus. I see there's no single setup that will be probably immune on these attacks, so, probably reducing or mitigating these exploitations was the right solution. Well, Bitget says user funds are safe and they'll remain operational, good thing they can sustain it but that stain will probably difficult to remove and users will probably migrate somewhere or these people will realize exchanges aren't ideal to store coins to begin with.