Can you walk us through it?

yeah about the biggest hack or theft ever until now until now i i really believe things are gonna get far worse than this so uh yeah basically what happened here is that from what we know from what binance said um a developer's laptop was compromised, right? If we see what has been happening in the last three years, nine out of 10 attacks of the big attacks that happened, all of them start with a laptop being infected, right? It's not just that it's just the laptop, but they start there.

A developer laptop is infected, From there, they were able to access a service container and they were able to sign transactions, right? What we think, right, because Binance didn't say too much up to now, is that there was no access to the private keys from the hot wallets from Binance.

but the attacker was somehow able to sign transactions.

It's like saying that you have, let's say, a pen in a bank that is used to write checks.

So every customer that goes to the bank and wants to withdraw money, that pen is used to write the checks.

So they didn't steal the check, but they were able to access the pen inside the bank and sign transactions.

But yeah, I think that a lot of this story is around operational security and ultimately that is like the single biggest thing that we keep seeing fail with all of these large exchanges.

Pablo's answer? Buy direct, but don't give them your real identity.

Everyone out there should have at least four emails.

Your company email, right, for company stuff.

Your personal email for personal stuff.

A private email that you do not share with anyone, and you use this email in your Apple ID, your Telegram, your recovery email address, your exchanges, et cetera.

And then a shitty email that you use to buy stuff, when you have to make a reservation or this and that.

So when, if you wanna buy If today I have to buy a Ledger or a Trezor, I would go into a website, I would use another email, another name, and I would send it to a hotel, to some friend's house, to some PO box.

So I asked Pablo directly, is self-custody now destined to be niche?

It's a little bit-

... on that, like, the, the attackers here, they exploited the zero-day vulnerability on a third-party security product that the exchange was using.

So the first thing is that they got inside the exchange because of a security product that the exchange was using, right? Security product that it's meant to protect you was the way in.

So first thing connected to that, and we have been saying this for years, is your security posture is as good as your provider's OPSEC, an operational security posture, right? And many people do not see that.

They just take care, if they take care of their OPSEC, which most of them, they don't do.

It's only what they are doing.

But Trezor didn't check, uh, the mailing list provider they were using.

[laughs]

If you're following what I'm saying, if the audience is following what I'm saying about pass keys versus two factor authentication, what can you tell us about like best practices with these and like, what are like common mistakes to avoid?

Yeah.

First, the reason why we have two-factor authentication, which is passwords are easily leaked in the dark web, right? As we said, I can go and search for anyone's email.

I will find on average 20 leaked passwords.

So if you repeat your password, I can go and try it.

with something called a checker, hey, try this email and this password in all these 150 websites, Citigroup, Binance, Coinbase, Airbnb, Booking, et cetera, right? So that's why we need two-factor authentication, right? To really make sure that it's you.

First thing that we started using was Google Authenticator, right? So you put your password and then it asks you for a code, a six-digit code.

to hack you because of the incentives and the reality is yeah a lot of recent sophisticated hacks were done by DPRK but not only let's say they are yeah our biggest enemy but they are other people in this shady shady market yeah