> took a private key from KMS

They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.

Do you have a source for that information? I'd like to read more on it.

It's explicitly mentioned in the article:

A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment

We've changed the URL to that link from https://bfmtimes.com/hacker-mints-80-million-worth-of-fake-s... above. Thanks!

Is there any proof, or even indication, that this wasn't an inside job?

Exactly. Stablecoins make zero sense.

Makes it easier to do pump and dumps, was never about "privacy" or "decentralization" as web3 types parroted 4-5 years ago. Monero is the exception btw.

Stablecoins aren't cryptocurrencies in any sense of the word. It's just electronic FIAT.

I don't know how this specific thing works, but I don't really see any fundamental problem with mixing and matching. If you believe in the benefits of crypto, then 50% crypto is still possibly better than 0%.

It's not like I forgo a lock on my front door just because my windows are made of glass.

If their coin requires a web service to process each transaction, then an offline key isn't very useful.

You can criticize their design, but you can't have a dude burning a CD-ROM every time someone wants some coins.

Have you actually tried to run a business this way?

They’re not really meant to go up in value.

The main use is just having something dollar-like that you can move around easily. That’s useful outside the US, but also for plenty of people inside the US depending on what they’re doing; especially businesses that have a hard time getting or keeping normal banking (cough gambling, porn, weed cough).

They’re handy inside crypto since you can move in/out of other assets without touching a bank. And sometimes you can earn yield on them, which is part of the appeal (with the usual “this can blow up” caveats).

Also, there’s a reason every company wants to launch one: if you control the stablecoin, you get the float and the rails. That’s a pretty nice business if people actually use it.

If you already have solid access to USD and don’t care about that flexibility, they’re less compelling.

But yeah, not risk-free at all (depegs, issuer risk, etc). And honestly there probably isn’t much real need for dozens of slightly different stables beyond the business incentives.

Why have cash? A: as an intermediary between better uses of money (buy cool stuff or invest)

So why use stablecoins and not use cash? When you want to quickly convert to/from a token (60 second not 6 days), but for a short period have a stable value. Or you want to avoid banks.

I.e. trading, gambling, drug deals, money laundering, etc.

I think the idea is if you're attempting to actually use crypto in the way that you would normally use money (ie, to buy/sell stuff) then you don't want the volatility. So in theory, it takes away the volatility while living within the crypto ecosystem.

But obviously...things happen. Just like cash is usually relatively non-volatile, but financial crashes happen.

To take advantage of the ability to send money that way without the volatility

first step is to turn them into real crypo like ETH (so its unfreezable)

then probably mix them via different methods

then sell them via OTC-style swap platforms like fixedfloat / changelly etc

Has to. As ETH they are probably still tracable.

stable as in "close the stable doors after the horse has bolted"

Sounds like it's working as designed!

I thought Tornado Cash was already taken off the OFAC list a year ago.

People love gambling. Get rich quick pitches have always been popular.

Now, as to why the SEC hasn’t regulated crypto out of existence.. I refer you to dementia Don

Not that it matters much, but this summary isn't right. The contract wasn't "exploited." The company's AWS account was compromised, giving the attacker access to a (off-chain) private key.

The contract relied on the key to mint new tokens. The hacker gained access to the key (through AWS) and with it minted as much as they'd like. It is certainly a valid take that a contract that only required the private key to mint an unlimited amount of the token isn't a good one, but you don't exploit someone's front door lock by grabbing the key from under the welcome mat.

Yeah, people who genuinely believe that don't have any problem with smart contracts getting exploited. Of course there are people who _say_ that because it's financially expedient at the time, then change their tune. But both groups exist and this is not really a gotcha.

The contract code said, "if you have a valid (off-chain) private key, you can mint tokens." The hacker gained access to their AWS account and ultimately their keys.

While I am happy to celebrate dumb crypto stuff, this isn't a situation where someone's code was "exploited." Their code was stupid, relying only on an off-chain private key to allow the minting of tokens. Their security was just also bad.