Uneasy Money: How the Resolv Hack Shows an Audit Doesn't Mean 'Secure'
Episode publishedPodcast: UnchainedUnchained
Transcript preview
Preview only
Hey, everyone. I'm Kane Warwick, and welcome to Uneasy Money because what happens on chain never stays on chain. Before we start, nothing new here on Uneasy Money is financial advice. We're just for builders talking about what's happening on chain, and we want you to always do your own research before aping it. You can find all our disclosures at unchainedcrypto.com/uneasymoney.
The energy network is an intelligent decentralized grid that coordinates smart devices to balance supply and demand. Energy Dollar is the native token of the network from one of Europe's fastest growing energy startups. Follow at FUSE Energy on X to find out more. Multichain Advisors is an emerging technology growth firm that has helped create 50 plus billion dollars in enterprise value for 80 plus clients over the past four years. They're the partner to help navigate markets, build real traction today at multichainadv.com. If crypto taxes feel overwhelming, you are not alone. That's why Crypt
Alright. I'm here with my cohost, Taylor Monahan, security expert. We definitely a few more security experts on this show this week where we got some stuff to cover. And Luca Netz, CEO of Punchy Penguins. And joining us today, have a special guest, Omer Goldberg, CEO of Chaos Labs. Welcome, Omer. We have a lot of wild stuff to cover today, so let's just dive in. The first thing is this resolve situation. $300,000 in and $54,000,000 gone. So what happened on Sunday night, I believe, in attacker compromised Resolve's AWS hosted private key, minted $80,000,000 of unbacked USR for 300 k, dumped it
Yeah. Well, I'm I'm very excited to hear Omar's perspective because for me, my perspective is this is actually there's a lot of wild stuff that happened, and there's a lot of complexity in what happened and how where bad debt was accrued, where the losses happened, where things can be improved there. But at the root, we do, in fact, go back to the fact that a single party had a single key. That thing was compromised by some bad actors and that allowed them to take unilateral action. And, apparently, this unilateral action, basically minting a whole bunch of USR was either not monitored or it m
On to AWS. Right?
On
AWS. So it's yeah. So it wasn't it's not quite your perfectly classic private key compromise, but it's about as close as as it gets. Basically, the key to AWS was compromised, and the AWS AWS and and basically all Infrared have, like, key management solutions. And so you, like, put your private key in this little section of AWS, and you're like, now it can't be exported. Now it can't be compromised. But in order to interact with that key and in order to take actions like minting or any sort of actions. Right? Wherever that key lives, you have to be able to interact with it. And so sometimes th
Right. So so just a question on that. Right? Like, so
Yeah.
Keep exploring with a free account.
A free account preserves the short preview. Upgrade to Pro for the full transcript and episode chat.