• Empire
  • Posts
  • 🕳️ ETH hole plugged

🕳️ ETH hole plugged

Bybit's $1.4B attack raises security questions

It’s bleak out here. Financial nihilism was funny at first, between the GameStop short squeeze and monstrously expensive ape NFTs.

Nowadays, it’s only grim. All irony has dried up to the point that whatever splash Kanye West hopes to make with his supposed memecoin is destined to be gritty spatter that’s outright painful for those involved and anyone watching from the sidelines.

One saving grace: the technology itself doesn’t know about any of this. It’s all happening on the social layer, which we all control within our own powers. Be the change you want to see in the crypto world.

Meanwhile:

  • BTC is in its third week of churn under $100,000. Current price: $95,960, down 0.5% in the past seven days.

  • $2 billion net has flowed into Binance hot wallets in the past week following the Bybit hack.

  • Polymarket open interest hits $128 million, its highest point since mid-January, per Blockworks Research data.

⬆️ Upping the game

I’ve learned my lesson. I will not be wishing everyone a peaceful weekend as part of our Friday send-off anymore. 

Bybit’s hack, which took place Friday morning, has sparked a slew of different conversations from security experts about how Bybit handled the situation. Last night, Bybit CEO Ben Zhou said the exchange was able to fully close the ETH gap and promised an audit report soon. 

I had the opportunity this weekend to chat with Ledger’s chief technology officer Charles Guillemet, who told me that, for the foreseeable future, this year is so far “the worst year for cybercrime in history.” 

Ledger fell victim to an attack just two years ago after a former employee was phished, giving attackers access to the package manager. Roughly $600,000 was stolen from Ledger users, a far smaller number than the $1.4 billion that Bybit suffered, but it led to Ledger removing the blind signing ability back in June of last year. Ledger’s CEO (and DAS speaker) Pascal Gauthier said in a statement that Ledger’s offered to support Bybit.

“This incident highlights once again that our industry needs to move beyond trust-based security models as attackers become more sophisticated. We can’t keep signing blind cheques and expecting it to be ok. The key evolution we're seeing is the shift toward enterprise-grade security solutions that combine Clear Signing with robust governance frameworks,” Guillemet said. 

His point is that attackers — like Lazarus, the North Korean group linked to the attack — are evolving and the current security measures used by the industry need to evolve as well.

“We need proactive security infrastructure that eliminates vulnerabilities like blind signing,” he explained. 

Guillemet also noted he has some concerns that this isn’t the end of Lazarus targeting Bybit. He said that he believes Lazarus “compromised several” of Bybit’s endpoints. 

“This suggests that Bybit’s machines and networks were compromised. I know pretty well their tactics and it's possible that they are still at work attempting a lateral move to compromise other parts of Bybit’s IT,” he told me, noting that this is clearly speculative but it’s better safe than sorry in these situations. 

“Pausing certain central functions of the exchange could have been wise, waiting for forensic investigations.”

I asked Guillemet what kind of lessons we can learn from this — especially given that $1.4 billion seems to mark this attack as the biggest digital heist in history of any kind, and not just the biggest crypto heist of all time.

“We've been saying this for years now. When the stakes are high, attackers raise the bar for their attacks. They won't stop here. And others will come. Stop signing blank cheques — instead, use enterprise-grade security and custody solutions built for managing a significant amount of value,” he said.

“Institutional-grade security isn't optional – it's fundamental.”

— Katherine

P.S. Help us build a better Empire and complete our short audience survey. Thank you!

DAS NYC Tickets Are Moving Fast — So Should You

The biggest names in crypto, finance, and policy are coming to NYC. VIP passes? Gone. The agenda? Live. With less than 30 days to go, the time to secure your spot is now.

Markets move. The smartest money moves first.

Groups of 4-9 still save 15%.

đź“… March 18-20 | NYC

  • Following the Bybit attack, the exchange saw roughly $4 billion in withdrawals in a “bank run.”

  • Su Zhu-backed OX.FUN pushed back against insolvency claims, calling it “FUD” after a user on X claimed that the crypto derivatives exchange laid off employees and only had $180,000 left in the platform.

  • Ouch! Raydium’s RAY took a nosedive after rumors floated that pump.fun could be launching its own automated market maker according to a pump.fun-connected URL.

🖼️ The same picture

So much has been made of the underperformance of ETH. 

Turns out, SOL is on track to match it almost to a tee.

A few weeks back, I pointed out that ETH is speedrunning the Intel stock chart — doing what Intel has done over the past 50 years in about a decade.

Here’s another in the series: The SOL/BTC ratio is on an almost identical path to the ETH/BTC ratio.

Below plots the price of both ETH (green) and SOL (purple) in terms of BTC (their bitcoin ratios), with some caveats: 

  • The SOL/BTC data begins 10 months into its trading history, in February 2021 rather than April 2020.

  • SOL/BTC has been moved forward to match ETH, as if both coins were launched at the same time.

  • ETH/BTC is sped up by 2x, which condenses two days of price action into one.

As you can see, the ETH and SOL bitcoin ratios are mapping eerily similar trajectories.

Both underwent large initial spikes of price discovery against BTC during their first bull markets — ETH in 2017 and SOL in 2021 — before collapsing throughout bear markets. 

Then they posted comparatively lackluster returns against bitcoin in the following bull market cycle: ETH/BTC mostly trended sideways between May 2021 and January 2023 but has since tanked by more than 60%. 

SOL/BTC has otherwise gone not much of anywhere between December 2023 and today. This would put SOL/BTC about where ETH/BTC was in mid-2023 — before the latter slid from 0.07320 BTC to 0.028 BTC over the next year and a half.

So, if SOL is indeed destined to track ETH relative to BTC, then the price of ETH going up against the US dollar — and fast — would surely help matters.

Bad news: ETH has technically entered a bear market. At least, that’s by one very basic definition, which suggests that a coin is in a bear market when its year-on-year returns are negative and vice versa.

It’s the same theory that says bitcoin’s most recent bear market, which spanned 490 days between February 2022 and June 2023, was its longest on record. ETH’s year-on-year returns were negative for almost that entire period.

As it turns out, ETH’s year-on-year returns (minus staking) again flipped negative 10 days ago, on February 14. That’s a first since June 2023 — which is either the very early innings of the current bull market or the very final moments of the previous bear market, depending on how you look at it.

— David

On our minds: Differences between memecoins

Katherine:

I’m totally on board with Nick Tomaino in this week’s Empire episode

In case you haven’t listened yet: Tomaino said he likes memecoins in the long term, but he’s not a fan right now. A lot of that has to do with what we’ve seen with pump.fun and how they’re being used. 

Tomaino pointed out that there’s a lot of sniping, and influencers are lined up to pump the coin, insiders take profits, and the retail crowd is left with the losses. Not really a fun game if we’re being honest, and definitely a bad look for crypto. 

I’m personally all for making memecoins fun again, which also would serve as a way to make it a little less casino-like in my humble opinion.

David:

Coin classifications are a huge mess.

There are governance tokens that are also methods of payment for a particular service or app, stablecoins that are not really stablecoins, and exchange tokens that more closely resemble exposure to a perpetual buy-back scheme than what’s historically been known as “utility tokens.”

Obviously, not all memecoins are the same. The cheap tokens churned out by pump.fun and other launchpads are probably closer to “rugcoins” than something like DOGE or PENGU. 

And celebrity coins like TRUMP or MOTHER could probably be considered something closer to the social coins like friends with benefits that swept crypto in the previous cycle.

It’s painfully boring and riddled with semantics, but there could be no better way out of this mess than actually defining what a “memecoin” actually is.