Hot Wallet Drains: Why Authorization Signatures Matter More Than Tracing Funds

·3 views

A DEV Community article argues that recent hot wallet breaches, including the $1.5B Bybit incident and a $3.3B hot wallet event, are typically analyzed by tracing where funds went rather than examining how the authorizing signature was produced. The author contends that the signature, and the key that created it, is the real attack surface, and that EIP-7702 delegation complicates this by letting externally owned accounts temporarily act like contracts. Current incident response tools can trace transfers within minutes but rarely verify what produced the authorization. The article proposes a checklist of properties for hot wallet authorization, including operator-signed scopes, append-only grants, fail-closed verification, and offline-verifiable receipts. Its central point is that verifying authorization before a transaction is more effective than detecting drains after they occur.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Tool That Generates Custom Birthday Songs From Any Name

A developer frustrated by slow, paid personalized birthday song services built a free web tool that creates an original song featuring a chosen name. Users enter a name, select a musical style such as pop or acoustic, and receive a fully synthesized track with generated melody, vocals, and lyrics within seconds. The system combines a lyrics generator, a text-to-singing model, and a style-matched instrumental generator, with particular effort going into fitting longer names naturally to the melody. Listening and sharing are free and require no account, while downloads are a paid option to cover bandwidth and generation costs. The creator is now seeking feedback on how unusual names are pronounced, as improving that is the next priority.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guidance on Delegating Website Tasks to AI Assistants

An AI assistant is useful for a website as a helper for drafting, reviewing, and organising content rather than as an autonomous administrator. Whether it can make actual changes depends on the connected system and the permissions granted to it. Teams are advised to identify which specific tasks to delegate and to keep a person checking the results. Tools such as MCP let applications expose capabilities to an assistant, but the available tools vary with server and account configuration. Before relying on an assistant, users should confirm its read-only versus save-capable access and verify any facts, claims, or product details it produces.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Moving a Production API to Hetzner: Choosing and Creating the Server

A developer recently migrated a small production API from one VPS provider to Hetzner Cloud and wrote this first part of a three-part series as both a record and a tutorial. The guide explains Hetzner's server families, comparing shared Cost-Optimized and Regular Performance plans against dedicated General Purpose ones, along with their pricing and intended uses. It also covers the separate billing for public IPv4 addresses and the need to check container image architecture before choosing Arm servers. Measured resource usage on the old server, about 1 GB, guided the choice of a 2 vCPU, 4 GB Cost-Optimized plan as the cheapest option with ample headroom. Prices are noted as subject to change, and the author advises checking current figures in the console.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Undead Agent: A Local AI Agent That Resumes After Being Killed

A developer built Undead Agent, a local AI tool that summarizes text files with an open-weight Gemma model running through Ollama. The agent runs as Temporal durable workflows, so when its worker process is forcibly killed, a new process picks up from the exact step where it stopped without redoing finished work. Each resurrection is narrated by a ghost-like persona, and a dashboard records every life, death, and resurrection. The project was submitted to the Hacktoberfest Open-Source AI Challenge and is available on GitHub, with a hosted demo page replaying a recorded run. The developer's aim was to show that long multi-step AI jobs can survive crashes without starting over and paying for repeated model calls.

0 comments Read more at DEV Community