CZ: Safe's incident report is vague and multiple issues remain unexplained
Binance founder CZ posted on social media that he doesn't usually criticize other industry players, but Safe's incident report used vague language to mask the problem. After reading it, there were more questions than answers, and the questions that came to mind for a while included:
- What does "sabotage the Safe {Wallet} developer machine" mean? How did they hack this particular machine? Is it social engineering, viruses, etc.?
- How does the developer machine access the "Bybit operated account"? Some code is deployed directly from this developer machine to the prod?
How did they cheat the Ledger verification step among multiple signers? Was it a blind signature? Or did the signer not verify correctly?
- Is $1.40 billion the largest address managed with Safe? Why don't they target others?
What can other "self-hosted, multi-signature" wallet providers and users learn from this?