Proof of Work: Binance gets hacked

Bitcoin • May 9, 2019, 2:31PM EDT
UPDATED: July 25, 2019, 6:02PM EDT
The Block

Quick Take

  • Binance, one of the largest crypto exchanges by volume, suffered a massive hack this week
  • The hack was the sixth-largest in crypto history, with around 7,000 bitcoins ($41 million) stolen
  • The exchange has said its SAFU insurance fund will cover its losses and that user funds won’t be affected
The following newsletter is republished with permission from Eric Meltzer of Primitive Ventures, a global venture investment firm with a focus on blockchain and related technologies. You can follow Eric on Twitter at @wheatpond and subscribe here to Proof of Work.

Binance suffered a hack this week, the specifics of which remain unclear. Some combination of multiple techniques allowed the hacker(s) to send themselves a single giant transaction of >7,000 BTC to an address under their control, from the Binance hot wallet. Binance announced that this would be 100% covered from their insurance fund, and that no user funds would be affected.

Jeremy Rubin, a BTC core dev and friend-of-the-newsletter had the following suggestion

 

You can replace “reveal the private keys” (which would allow miners to make their own transactions spending the hacker’s coins to miner addresses) with “create a double-spend of the hack transaction back to a Binance-controlled wallet, and add a massive fee—700 BTC? 7000 BTC?—to incent miners to reorg the chain to reflect the Binance transaction rather than the hacker’s transaction.”

This suggestion was made when roughly 50 blocks had elapsed, so what Jeremy was suggesting would require a massive amount of hashpower to pull off. It’s also not a new suggestion (the wonderful Bitmex Research pointed to this thread) and so far it’s never actually been tried. In general, sentiment in the community was so massively against this move that it probably would have caused a chainsplit, and therefore been untenable.

However, would it be advisable for an exchange who has just been hacked and realizes it VERY rapidly to try this after only 2-3 blocks have elapsed? The bitcoin chain is reorg-ed by a few blocks occasionally in the course of normal mining, which is part of how the “wait 6 confirmations” rule came about. If the exchange noticed the hack within 2 blocks, or even before it made it out of the mempool, and immediately submitted a competing transaction with a much higher fee, I don’t think most of the community would have any problem with it. However, if exchanges started doing this frequently, they would perhaps be incentivizing miners to hack them, since the miners know that the exchange will attempt to “burn” the hacked funds into fees…

Anyway, this story has an uneventful and perhaps happy ending:

So for now, this has been a koan-like lesson on the nature of Nakamoto consensus and its lack of transaction finality, but we didn’t get to see how Bitcoin would behave in a particularly extreme scenario.

More next week, as always thanks for reading!

Bitcoin & Friends

Optech on Bitcoin

  • Bitcoin Core 0.18.0 released

  • Proposal for support of Schnorr signatures and Taproot script commitments: Pieter Wuille posted to the Bitcoin-Dev mailing list a proposed BIP for Taproot (using Schnorr signatures) and a proposed BIP for Tapscript, a small variation on Bitcoin’s current Script language to be used with Taproot encumbrances.

James from Summa

Summa builds tools to exchange crypto in a convenient and trustless fashion.

  • We added a basic infura websocket client to riemann-ether

  • bitcoin-spv now has tools for calculating Bitcoin sighashes on-chain and verifying Bitcoin signatures, plus a better readme :)

Tony from Kadena

Kadena is building Pact, a formally verifiable smart-contracting language for financial applications, and Chainweb, a PoW blockchain that uses multiple chains in parallel to increase throughput.

  • Monica Quaintance presented Kadena’s hybrid blockchain and its enterprise applications at MIT Technology Review’s Business of Blockchain conference.    

  • Looking ahead in May, Kadena's Will Martino, Stuart Popejoy, and Monica Quaintance are speaking at Consensus and then we're aiming to release testnet v1 at the end of the month.

  • The Kadena team would enjoy meeting up with folks during New York Blockchain Week. Read about the events we're participating in on our Medium post.

  • Eliminated network/chain malleability attacks in application layer PR 153.

  • Implemented "Adaptive" Difficulty Adjustment for improved early network conditions PR 167.

  • Mining hashrate target calculation performance improvement PR 115.

  • Better legibility of compiler errors in Pact SDK PR 467.

  • Monica Quaintance and Tarun Chitra of Gauntlet Networks published a security paper, covered by Forbes, that proves Chainweb as the first scalable Proof of Work blockchain.

  • Emily Pillmore and Stuart Popejoy were interviewed on Hashing It Out to discuss Pact, the smart contract language with built-in Formal Verification used in Kadena's Chainweb.

  • The Next Web published Stuart Popejoy's analysis of how IBM's Hyperledger is not a real blockchain.

Aviv from Spacemesh

Spacemesh is a programmable cryptocurrency powered by a novel proof-of-space-time consensus protocol.

  • ED25519 Public Key Extraction Go Library

    • https://github.com/spacemeshos/ed25519

    • An open-source drop-in replacement to golang/crypto/ed25519 with additional functionality.

    • We have developed this for the Spacemesh protocol since we could not find a good open source alternative. We hope that the open source blockchain dev community will find these capabilities useful in other scenarios and platforms. 

    • In the ed25519 signature scheme, in order to verify the validity of a given signature, the validator should posses the public key of the signer. It can be sent along with the message and its signature, which means that the overall data being sent includes 256 bits of the public key. 

    • Full update => https://spacemesh.io/weekly-updates/ 

JZ from Decred

Decred is an autonomous digital currency with a hybrid consensus system. It is built to be a self-ruling currency where everyone can vote on the rules and project-level decision making proportionately to their stake.

Johnny from Stellar

Stellar is an open network for sending and exchanging value of any kind. Its global network enables digitization of assets - from carbon credits to currencies - and enables movement around the internet with ease.

  • Stellar v11.1.0 is scheduled to be released at the end of the month.

  • Horizon v0.17.6 released this week with minor fixes

  • New Go SDK released, announcement & v1.1 is out.

Izaak from Coda

Coda is the first cryptocurrency protocol with a constant-sized blockchain. Coda compresses the entire blockchain into a tiny snapshot the size of a few tweets using recursive zk-SNARKs.

  • Jiawei has started implementing the stake-voting augmentation to our consensus mechanism. Read the RFC here to learn more about how this makes Coda resilient against long-lasting network partitions.

  • Avery and John have been working on the GraphQL API.

  • Echo fixed a race condition in the transaction pool.

  • Paul worked on implementing thetrust system.

Privacy coins

Paige & Zooko from Zcash

Zcash is a digital currency utilizing zk-SNARKs to enable its privacy-protecting properties.

Mitchell from Monero

Monero is a open-source, privacy-focused cryptocurrency using the ASIC-resistant CryptoNote PoW algorithm. It enforces all privacy features at the protocol level to ensure that all transactions create a single fungible anonymity pool.

Daniel from Grin

Grin is a community-driven implementation of the Mimblewimble protocol that aims to be privacy preserving, scalable, fair, and minimal.

Beni from Beam

Beam is a confidential and scalable cryptocurrency based on Mimblewimble.

  • We will be attending some super cool events during the NYC Blockchain Week 2019, this is here to know all the wheres and whens

  • Have a look on this Atomic Swap Demo done by Beam’s CTO, Alex Romanov

  • R&D Updates

  • We have begun the preparation for the Fork Release

  • Good progress on the Lightning Network POC (Laser Beam)

  • Still a lot to be done when it comes to the integration with Trezor T and to the development of our Atomic Swap Feature #447

  • Work in progress on Bright Boson 2.1 for Desktop and Mobile wallets

  • Work on the Mobile Restore functionality

  • We have begun to develop the following features:

    • Add dialogue window on "Confirm seed phase" screen #132

    • Reference Exchange Rate for Wallet Balance #127

Arnaud from AZTEC Protocol

AZTEC Protocol is an efficient zero-knowledge protocol built on top of Ethereum, making plug-and-play value transmission and asset governance privacy tools for developers and companies. 

  • We have submitted an update to EIP-1108, which aims to reduce the gas costs of key opcodes and precompiles used in elliptic curve cryptography. This EIP would benefit a variety of protocols (including Zether, Rollup, Matter Labs and of course AZTEC). For example, an AZTEC transaction would go from ~820k gas to about 197k gas.

  • Our work on a better client side library continues, focussing on making APIs more developer friendly friendly.

  • This week our CTO Zac was on the Zero Knowledge Podcast, talking about range proofs, standards, and privacy on Ethereum.

  • In addition to the two cryptographer roles, we are now hiring for a Senior Solidity Engineer and a Senior Engineer. You can apply here, or by emailing [email protected] with the name of the role as the subject.

Smart contracting platforms

Evan from Ethereum

Ethereum is a decentralized platform for applications that aims to resist fraud, censorship or third-party interference.

Jing from Plasma

Plasma Group is building "Generalized Plasma", a layer 2 scaling infrastructure for Ethereum that allows for general state transitions on layer 2.

  • Published explainer of the generalized plasma architecture on medium.

  • Prototyped research of offline atomic swaps, allowing for batch defragmentation

  • Cleaned up the last of the research blockers for plasma payments

  • Had a cringey AMA on Youtube Live.

Erik from NEAR

NEAR is a sharded proof-of-stake blockchain.

AJ from Tezos

Tezos is a self-amending blockchain that features formally verified smart contracts, on-chain governance, and a proof-of-stake consensus algorithm which enables all token holders to participate in the network. 

Topper from Quorum Control

Quorum Control makes Tupelo, a permissionless proof of stake DLT platform purpose-built to model individual objects that enables flexible public or private data models.

  • Ongoing Production Framework of Tupelo TestNet

  • Infrastructure improvements focused on bootstrapping process for signing nodes

  • Overnight daily performance benchmarking process in development

  • Protobuff conversion of internal type handling - more seamless types between SDKs

  • Read our published post “No Smart Contract Needed: Real Estate on Tupelo”

Michael from Loom

Loom Network is a platform for building highly scalable DPoS sidechains to Ethereum, with a focus on large-scale games and social apps.

  • Released DPoS V3.0 -- includes multiple delegations per user, redelegations to other validators, merging of reward delegations, referrer rewards for wallets, voting power cap, statistics in preparation for enabling slashing, web3 Json interface now works with block explorers, Go contracts have alpha support via web3, and various bug fixes

  • Launched Trezor support for PlasmaChain staking via Metamask

  • 188M LOOM tokens are now staked on PlasmaChain, which amounts to ~24% of circulating supply

  • Battle Racers is the latest game being built on Loom

Myles from EOS

EOS is a new blockchain architecture designed to enable vertical and horizontal scaling of decentralized applications.

THE SCOOP

Keep up with the latest news, trends, charts and views on crypto and DeFi with a new biweekly newsletter from The Block's Frank Chaparro

By signing-up you agree to our Terms of Service and Privacy Policy
By signing-up you agree to our Terms of Service and Privacy Policy

  • The EOS resource exchange (REX) is officially live on the mainnet 

  • EOSIO v1.8.0 release candidate published. New features will allow dApps to abstract away blockchain resource management from end-users. 

  • Dan Larimer published an idea for a new model for decentralized stablecoins 

  • EOS New York put forth a proposal for a new form of blockchain revenue. Read more about it in Greymass's post here

  • Liberland announced that it will use EOSIO to build various blockchain-based government services

Zaki from Cosmos

The Cosmos Network is a decentralized network of independent, scalable, and interoperable blockchains.

Kate and Dean from Agoric

Founded by pioneers in secure development and distributed systems, Agoric uses a secure subset of JavaScript to enable object capabilities and smart contracts.

  • On our Electronic Rights Transfer Protocol (ERTP) branch, Mark has made some major advances. We’ve split our purse abstraction into ‘purses’ and ‘payments,’ where payments represent digital assets in transit, with the transfer rights locked up. We’ve also added a way to generalize kinds of digital assets (fungible, non-fungible) and valid operations on them. Lastly, our contracts now have a flexible API for representing a particular position in an ongoing smart contract, which can itself be bought and sold. Someone who buys a position in a smart contract can verify with the contract host to see what they would be joining.

  • We implemented a new device model for their "SwingSet" environment, in which external functions are made available as capability-oriented "device nodes", allowing them to be shared between vats and managed just like normal objects. This will support inter-machine and inter-chain communication links in the next few weeks.

  • We’ve added a “Comms” vat to our SwingSet environment, which is responsible for sending and receiving messages from external machines and translating and relaying them to other vats on the same machine.

Financial Infrastructure

Antonio from dYdX

dYdX is a decentralized exchange for margin trading, borrowing, lending, and eventually derivatives. dYdX allows traders to trustlessly short and get leverage on crypto assets.

  • Just 5 days after our public launch we're already up to over $2.3M outstanding supply and $800k outstanding borrow on dYdX!

  • Shipping new frontend features: Added tooltips to the app and working on adding trade history

  • Working on adding USDC to dYdX. If you're interested in lending or borrowing high volumes of USDC please reach out to [email protected]

  • Hiring product designers and engineers full-time in SF!

Coulter from MakerDAO

Maker is comprised of a decentralized stablecoin, collateral loans, and community governance.

  • April was extremely eventful for Maker, so if you missed anything, get a recap of all updates, partnerships, and more in our Making Maker blog post.

  • Maker has become an associate founding member of the International Token Standardization Association (ITSA). More info here.

  • On our weekly community call, we demoed a first look at the Multi-Collateral Dai CDP Portal. Coindesk recapped it.

Lazar from MARKET Protocol

MARKET Protocol is a framework for creating tokens that track prices of traditional or digital assets.

  • Completed rewards program UI design

  • Rolled out alerts and notifications using PagerDuty

  • Added MKT:USD rate endpoint to MPX API

  • Integrated new contracts and middleware with MPX admin

  • Refactored MARKET.js in preparation for integration with ethers.js (web3 replacement)

Robert from Compound

Compound is a money market protocol on the Ethereum blockchain — allowing individuals, institutions, and applications to frictionlessly earn interest on or borrow cryptographic assets without having to negotiate with a counterparty or peer.

Layer two and interoperability

Rahul from 0x

0x is an open protocol that enables the peer-to-peer exchange of assets on the Ethereum blockchain.

Tony from Liquidity.Network

Liquidity Network is a transfer and swap platform for any token

  • Liquidity Network releases v2 of the mobile app with the following cool features. Details can be found here.

    • Sleek design and cool interface

    • Support for ERC-20 tokens on-chain & off-chain

    • Support for $DAI

    • Improved user experience

    • Hub security checks   

  • Integrating the TEX library into the front-end and working on client performances

Dong Mo from Celer

Celer Network is a layer-2 scaling platform that enables fast, easy and secure off-chain transactions for not only payment transactions, but also generalized off-chain smart contracts.

  • We finished new “Backup your wallet” flow and tested Alpha Mainnet OSP config and mobile SDK.

  • We tested game inviting flow, fixed bugs and edge cases.

  • We tested and refined app adaptability for different games from the developer portal.

  • We've completed dispute design UI flow for fully decentralized turn-based games and the setup of a new backend stack for Alpha Mainnet Launch.

  • We are in the process of testing and fixing issues found on the new backend.

  • We have Implemented a more robust on-chain event monitoring and support payments with numeric conditions, not only boolean.

Alexandra from Parity Technologies

Parity Technologies builds core blockchain infrastructure, from Parity Ethereum, an Ethereum client, to Polkadot, an interoperable blockchain network.

Application infrastructure

Wes from Theta

Theta is an end-to-end infrastructure for decentralized video streaming.

  • Improved off-chain transaction batching logic, resulting in 80% reduction in redundant/unnecessary on-chain transactions for a given number of concurrent users

  • On the streaming side, introduced new technique of slicing video into smaller segments, improving peering efficiency

  • Completed first monthly distribution of TFUEL for users running the Pre-Guardian Node client

Doug from Livepeer

Livepeer is a decentralized video infrastructure network, dramatically reducing prices for developers and businesses building video streaming applications at scale. 

  • Writeup and summary of the DTok, decentralized TikTok, app built by the Stake Capital team on Livepeer.

  • Achieved 99.5% success rate for live video transcoding on the Streamflow test network. Targeting over 99.99% before mainnet upgrade.

  • Shipped "API Node" to create simple REST interface for developers getting started with Livepeer's upcoming Streamflow release.

Ryan from FOAM

FOAM is building spatial applications and proof of location that bring geospatial data to blockchains and empower a consensus driven map of the world.

  • Highest amount of activity on the FOAM Map yet, this week saw 25+ challenges with active voting. The voting contract increased from 400k tokens to 800k , 1.7m, 2.7m to over 7m tokens. 

  • Third weekly scavenger hunt with Blockcities complete, now utilizing an Ethereum logic app running on Microsoft Azure cloud infrastructure for automation. 

  • Cartographer Tools Dashboard - Development Preview released 

  • FOAM Map Developer Grant program announced! We are excited to see what will be built from this.

  • FOAM at New York Blockchain Week: Find us at Ethereal, Token Summit and ETH New York hackathon happening at the FOAM Offices in the New Lab. We will be hosting workshops, talks and API prizes. 

Other

Bowen from Hydro/DDEX.io

Hydro Protocol is an open source framework for building Decentralized Exchanges. DDEX is the first decentralized exchange for Ethereum and ERC-20 tokens built on the Hydro Protocol.

Sam from OpenBazaar

OpenBazaar is an open source project developing a protocol for e-commerce transactions in a fully decentralized marketplace.

  • OpenBazaar version 2.3.3 was released. This release includes one of the most significant UX improvements to date: Listings load almost instantly. We've changed how we do IPFS and IPNS calls, as well as added a tiered routing structure, and the result is a huge improvement in loading speed.

  • The infrastructure needed for the social features of the Haven app is now completed, and internal testing of the app is reaching the final states.

China & Asia Updates

Mining ?

  • Other than Sparkpool and F2pool, the majority of top Asian PoW mining pools show no interest in staking, due to the current limited TAM (~$6B of total PoS coins) and there is no advantage when competing with exchanges and wallets for stake access

  • After the recent “China Mining Ban”, $BTC hash rate sees a steady growth back to 54E, now less than 10E from ATH 60E

Trading/Exchanges ?

  • UEX, an Asia based exchange shuts down due to “Business Adjustment”

  • Korea exchange CoinBin (formerly Youbit) filed for bankruptcy with a loss of $26M and a series of scandals involving executive inside jobs and exit scams

  • We are expecting more mid-to-small sized exchanges started in the last cycle to shut down over time

  • A strong signal of the IEO hype dies down is from the recent Binance Launchpad IEO $MATIC: over 58% of the IEO participants won the $MATIC allocation ticket via the lottery system. The previous IEO $CELER saw a lottery win rate of only 1%. The significant decline of the Binance IEO hotness indicates the wave of IEO hype is quickly fading away

Regulation ?


© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

More by Eric Meltzer