Bitget Hack, Duelbits, ColdCard, Haruko, Liquid - Time to change?

[tperkara]

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

[Darker45]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either. 

So, which cliché to do away with? Internet must be freed from whom?

[TypoTonic]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either.

So, which cliché to do away with? Internet must be freed from whom?

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

[Taskford]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either.

So, which cliché to do away with? Internet must be freed from whom?

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

Real problem is they think that having a key is enough, but the problem is they are actually still exposed for exploits and other issues.

So even if there's no methods could guarantee them 100% protection, still they could do something like setting up multiple safeguard to lessen their chance to hit by an exploit.

Better aim doing things that can enhance their safety and don't join with wrong opinions, because that might give them a painful lesson which for sure they don't want to experience.

[Z-tight]

Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same.

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next. I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

Security of funds has always been something that should be taken seriously. Yeah, i understand that attacks have gottem more sophisticated, but it has always been a rule to protect your BTC from attackers and never expose your seed phrase.

[Darker45]

~snip~

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

Which then brings us to a cycle. Because humans are said to be inherently weak, various services are offered, including banks and other custodians. But then banks and custodians themselves also failed in their responsibilities. Therefore, individuals must take back what they've entrusted to them. But because they're inherently weak, they also failed. So, yeah, there must be no perfect way.

Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same.

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next. I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

And what about the Ledger Recover subscription? But you could go more technical, but the point remains.

[Z-tight]

And what about the Ledger Recover subscription? But you could go more technical, but the point remains.

I hate Ledger Recover and its implementation was were a lot of people drew the line with Ledger and their devices, and that's completely valid. In the future, it could lead to loss of funds, but right now it hasn't and that's why people don't really talk about it, but Coldcard that fucked their customers over. Yeah, it is a stupid idea to split a seed phrase into three fragments and send them over the internet, nobody should subscribe to that rubbish.

[tabas]

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

And this is the responsibility of these platforms and so as we as individual users, we also need to be aware of our own security. While these platforms can be accountable if ever a small hole has been abused to them, they can potentially what is lost for their users. But we as individuals, if you are at fault there's no way that you'll get a potential refund or safu or however they call those funds recovery programs they have. We are our own security and we protect ourselves depending on the practice that we do.

[TypoTonic]

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next.

That incident doesn't make every other hardware wallet unreliable. Coldcard got compromised due to their weak seed generation, but the risk could've been mitigated by using a strong passphrase.

I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

It serves as a reminder for users to generate their own seed phrase, and not to blindly trust any single device. Self-custody has risks, but it's our own responsibility to minimize them.

[Z-tight]

That incident doesn't make every other hardware wallet unreliable. Coldcard got compromised due to their weak seed generation, but the risk could've been mitigated by using a strong passphrase.

I know all this, i am talking about new users in the network and those whom i recommend self-custody over custodial storage to, they are not wrong to think in that way. As for a strong passphrase, it is a great extra layer of security, but you wouldn't always need it not to lose your funds, your seed phrase is enough, as long as you don't expose it. It would be unfair to turn to the Coldcard victims and ask them why they didn't extend their seed words with a passphrase.

It serves as a reminder for users to generate their own seed phrase, and not to blindly trust any single device.

It is not the most newbie-friendly thing to do, and rather than recommend this to newbies, it would be better for them to allow their wallet generate the seed phrase for them, so they don't screw themselves up.

[Bitcoin-Forever]

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

There is nothing new introduced to add up to our security done for everyone to maintain the normal standard of what is expected of them to do with bitcoin network and this usual check to safety, you have to be updated and also learn more about privacy and security, know the different kinds of wallet we have in cryptocurrency and understand their differences and know their vulnerabilities also, despite all this forms of attack that has taken place, it's not all of us we are being affected.

[EarnOnVictor]

Are you for real? AI agent attacks??? That's not cool! Blaming everything on your so-called "AI agents" is alarming. Most crypto security failures are due to phishing, human carelessness, compromised third-party access tokens/software/access, classic smart contract exploits, and delayed security upgrade. Nonetheless, self-custody cold wallet is good, but blaming it on "AI agent" is unfair.

[cryptomaniac_xxx]

And this is the responsibility of these platforms and so as we as individual users, we also need to be aware of our own security. While these platforms can be accountable if ever a small hole has been abused to them, they can potentially what is lost for their users. But we as individuals, if you are at fault there's no way that you'll get a potential refund or safu or however they call those funds recovery programs they have. We are our own security and we protect ourselves depending on the practice that we do.

With the hacked on Bitget, it's more of the responsibility of exchanges, although they said that they can covered what has been lost. But still though, that is very bad security on their end because this is not the first time that it did happened to them.

That's why in order to heightened their security, they should also allot millions to their infrastructure and their people and train them 24x7 on how to spot a hack and then stop it right then so that they can still salvage some money and not let the hackers take everything they can.

[Findingnemo]

Are you for real? AI agent attacks??? That's not cool!

For starters, the real Bitget hack was in 2024, and was around $8 million, not $351 million, plus Duelbits hasn't reported a $7 million breach. Not the one I am aware of.

Bitget and Duelbits hacks were confirmed news, and we even have the official confirmation from them on X about the hacks. Duelbit came back live and the lost funds are already covered by the owner himself but I am not sure about the bitget update.

[EarnOnVictor]

Are you for real? AI agent attacks??? That's not cool!

For starters, the real Bitget hack was in 2024, and was around $8 million, not $351 million, plus Duelbits hasn't reported a $7 million breach. Not the one I am aware of.

Bitget and Duelbits hacks were confirmed news, and we even have the official confirmation from them on X about the hacks. Duelbit came back live and the lost funds are already covered by the owner himself but I am not sure about the bitget update.

Thanks for the correction. I double-checked now, and you guys are right, as there were recent breaches just last month. I didn't do my background digging, but relied on the old info I had, plus I didn't remember receiving a breaching emails from Bitget and Duelbits. I've adjusted my post accordingly, but still maintain the so-called "AI agent" hacking debunking."

[Findingnemo]

Are you for real? AI agent attacks??? That's not cool!

For starters, the real Bitget hack was in 2024, and was around $8 million, not $351 million, plus Duelbits hasn't reported a $7 million breach. Not the one I am aware of.

Bitget and Duelbits hacks were confirmed news, and we even have the official confirmation from them on X about the hacks. Duelbit came back live and the lost funds are already covered by the owner himself but I am not sure about the bitget update.

Thanks for the correction. I double-checked now, and you guys are right, as there were recent breaches just last month. I didn't do my background digging, but relied on the old info I had, plus I didn't remember receiving a breaching emails from Bitget and Duelbits. I've adjusted my post accordingly, but still maintain the so-called "AI agent" hacking debunking."

AI hacking is clickbait in my opinion, they don't do anything better than humans do until now. Maybe they are performing low level social engineering tricks for now and we had seen one of the government website had unauthorized access from chatgpt and we also had seen the GPT 6 which can performa tasks on its own by taking the control of our devices but yet they are not on the elevel of exploiting the vulnerabilities yet.

[tabas]

And this is the responsibility of these platforms and so as we as individual users, we also need to be aware of our own security. While these platforms can be accountable if ever a small hole has been abused to them, they can potentially what is lost for their users. But we as individuals, if you are at fault there's no way that you'll get a potential refund or safu or however they call those funds recovery programs they have. We are our own security and we protect ourselves depending on the practice that we do.

With the hacked on Bitget, it's more of the responsibility of exchanges, although they said that they can covered what has been lost. But still though, that is very bad security on their end because this is not the first time that it did happened to them.

That should really be covered by them with the losses they've made through the hack. But, for how long they'll be able to? What if there's another version of this hack and they were targeted again by these hackers? I don't think that they'll be able to afford to cover the expenses and refunds of their users although they should still do it.

That's why in order to heightened their security, they should also allot millions to their infrastructure and their people and train them 24x7 on how to spot a hack and then stop it right then so that they can still salvage some money and not let the hackers take everything they can.

I agree, money that's in the security means that money is invested well in protecting not just the user's funds but also the exchange's.

[noorman0]

That should really be covered by them with the losses they've made through the hack. But, for how long they'll be able to? What if there's another version of this hack and they were targeted again by these hackers? I don't think that they'll be able to afford to cover the expenses and refunds of their users although they should still do it.

Even assuming they succeed with the first recovery, they would still need to carry out restorations for a second incident and subsequent ones (likely under increasingly unfair terms) until their reserves are completely exhausted. Therefore, the crucial point is this: if users place their trust in an exchange simply because it holds "sufficient" restoration reserves, they must also consider the worst-case scenario should those reserves begin to dwindle.

[dkbit98]

Perhaps the time has come to change our mindset regarding online security, to do away with old cliches, and to demand security, privacy, and anonymity. Internet must be freed.

I don't see this happening any time soon, it's more likely they will add more restrictions and ask for more verification to use internet.
In fact I think they are going to use increasing number or hacks/exploits, as excuse to introduce heavy restriction and kyc on whole internet.
This is not my imagination, this are real plans proposed by some lunatics in public.

[tabas]

That should really be covered by them with the losses they've made through the hack. But, for how long they'll be able to? What if there's another version of this hack and they were targeted again by these hackers? I don't think that they'll be able to afford to cover the expenses and refunds of their users although they should still do it.

Even assuming they succeed with the first recovery, they would still need to carry out restorations for a second incident and subsequent ones (likely under increasingly unfair terms) until their reserves are completely exhausted. Therefore, the crucial point is this: if users place their trust in an exchange simply because it holds "sufficient" restoration reserves, they must also consider the worst-case scenario should those reserves begin to dwindle.

I think that mindset of users have been into that point due to the hardware issue, there's no more trustworthy where they can put their deposits. But that's a wrong thinking even if the exchange has sufficient reserves and funds or will always say that funds are safu, it won't make sense if the entirety of it has been depleted by the hacks and they haven't recovered yet from the massive attack that they have gone through.