The Resolv hack: How one compromised key printed $23M (chainalysis.com)

by timbowhite 163 comments 117 points
Read article View on HN

163 comments

[−] primitivesuave 53d ago
Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.
[−] WatchDog 53d ago

> took a private key from KMS

They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.

[−] pants2 53d ago
^ this is a common security misconception in crypto. "We're using an HSM, they can't steal our private key." OK genius now you still have to secure the HSM.

There's no shortcut to MPC/multisig with 3+ keyholders.

[−] Ferret7446 53d ago
It's still significantly better, since access can be revoked, vs a leaked key where you're permanently fucked
[−] pants2 53d ago
Not much better because even a single signature can drain your whole wallet.
[−] WatchDog 53d ago

> you still have to secure the HSM

Obviously.

> There's no shortcut to MPC/multisig with 3+ keyholders.

The whole concept of a stablecoin seems to be based on centralised trust. Ultimately there is some org that has the fiat bank account, that mints and redeems the coins.

[−] heartlinmachado 48d ago
[dead]
[−] thebiblelover7 53d ago
Do you have a source for that information? I'd like to read more on it.
[−] abrookewood 53d ago
It's explicitly mentioned in the article:

A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment

[−] bob1029 53d ago

> The attacker compromised Resolv’s cloud infrastructure to gain access to Resolv’s AWS Key Management Service (KMS) environment where the protocol’s privileged signing key was stored.

Ok, but how was the AWS infrastructure compromised? This appears to be the crux of the entire article.

AWS is very hard to break if you are using the IAM roles properly and avoiding manual secret management. If the only thing that can even sign a JWT is a very specific blessed EC2 instance that has exclusive access to KMS, your attack surface is nearly zero by comparison to a similar setup where administrators use email or Discord to communicate API credentials.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-role...

The protocol around using an HSM is just as important as the machine itself. It seems like some of us are going to be speed running PCI-DSS the hard way.

[−] Aurornis 53d ago
According to a writeup at https://www.chainalysis.com/blog/lessons-from-the-resolv-hac... this started with a plain old hack that compromised their signing key.

They also had a smart contract which didn't do some proper checks, but the hack was only possible with the stolen private key. Whoever held the private key was able to mint a lot of money, unchecked.

So there was a traditional hack at the core of this heist, not just a smart contract exploit.

[−] andai 53d ago
If the admins can "lock all transactions", what's the point of it being a crypto?
[−] FpUser 53d ago

>"However, the hacker was only able to siphon off $25 million; the rest was locked into the protocol after system admins got alerted."

"Only" ?!!! Poor thing.

[−] cameldrv 53d ago
You shouldn't have a key that controls millions/billions of dollars on a cloud service. It should be on an airgapped laptop that was purchased anonymously, has never been connected to the Internet, and only runs software that has been vetted and loaded onto it via a CD-ROM or some other comparable method.
[−] dmitrygr 53d ago
Self-Funding Bug Bounties strike again.
[−] amarant 53d ago
What is the point of stable coins? Like why does anyone buy them?

It seems to me that their initial value is 1usd per token (or some other fiat I guess) and that's also the roof of their value: they kinda guarantee that they won't become more valuable than that.

They are less usable than fiat: more businesses accept fiat than crypto, especially weird and small coins like all stable coins are.

There isn't really a floor to their value, as demonstrated here.

I see plenty of downsides of owning one of these coins, but not a single upside?

Yet people apparently do buy them, so what is the upside? There must surely be something that's good about them?

[−] m0llusk 53d ago
stable as in house always wins?
[−] onemoresoop 53d ago
Could this be an inside job?
[−] s_u_d_o 53d ago
And what happened next? He mixed those coins? Transformed them into monero?
[−] RS-232 53d ago
Has to be an inside job. One doesn’t just simultaneously hack into an AWS account, know exactly which key is needed for coin minting, and know internal details necessary to exploit a smart contract. The nature of the hack practically reveals their identity.
[−] consumer451 53d ago
Oh wow, there's another interesting story on that site:

> Trump Administration Likely to Un-ban Bitcoin Mixers, Dept. of Treasury Says They are “Not Unlawful”

https://bfmtimes.com/trump-likely-to-un-ban-bitcoin-mixers/

[−] tekla 53d ago
Hacker? The coins were minted with perfectly valid code.
[−] gverrilla 53d ago
not even news.
[−] dafelst 53d ago
But guys, what you don't understand is that the code IS the contract!!! That means you don't even NEED regulation!!
[−] heartlinmachado 48d ago
[dead]
[−] Franklinwhite 53d ago
[dead]
[−] outside2344 53d ago
How is this industry still an industry?
[−] momoddo 53d ago
[dead]
[−] le-mark 53d ago
Tl;dr another bug in a smart contract exploited, hacker got away clean.
[−] AIorNot 53d ago
dang.. stealing money from fools and speculators.
[−] Panzer04 53d ago
Why does everything have to be written by an AI?