JK

Pulled the on-chain data on 0.0.3229. What it actually is: Hedera's own mirror-node monitoring daemon — memos decode to "Monitor crypto on hiero-mirror-monitor-[k8s-pod]." Running since Sept 13, 2019. A 1-tinybar transfer to itself, ~1.8x/second, forever, paying its own fees. Fair caveat: over all time it's only ~0.23% of the "71B transactions" headline. Not what's padding that number. The part that matters: right now it's ~20% of ALL @hedera mainnet transactions. Oct 25–31, it sent 1.11M of the network's 5.43M. Daily range 15–27%. Not fraud — legitimate infra testing. But when a fifth of your live network is your own monitoring script pinging itself, "look how active we are" doesn't mean what the dashboard implies. Real usage is thin enough that internal test traffic dominates the feed. Transaction count was never a usage metric. A cron job can be a fifth of it.

Thanks for covering @HSuiteNetwork @aguille_ 🙌 Truly appreciated!!

Not decentralization by declaration. Accountable governance, by design.

It can happen on any pc and wallet, if singlesig and key is stored in an accessible way for malicious actors. What makes @HSuiteNetwork wallet unique though is the change to setup multisig at zero extra cost, hence you can use for example your pc + daily phone + hidden phone (or tablet or laptop) to create a 3/3 multisig you can control by yourself with multiple devices/signatures. As always, multisig is the way and HSuite is on top of it since years.

$6.3B. Largest crypto theft ever. The cryptography never broke. No key "leaked." A DevOps laptop got compromised, the attacker reached an internal signing pipeline, and had it produce valid authorizations. The math held. The boundary around *what can make the system sign* didn't. "But multi-sig?" An exchange signs thousands of withdrawals a minute — no human clicks approve. The signers are automated. If one process can reach them, it doesn't steal keys; it asks, and the infra signs, because that's its job. m-of-n means nothing when one actor can summon all n. WazirX was multi-sig. Bybit was multi-sig. Both drained. Signatures don't protect you when a single point can make the system produce them. On Ethereum this ran through EIP-7702 — one authorization was all it took. Both are real flaws: the signing path reachable by one human is what let them get a valid authorization at all, and 7702 made it permanent — one auth turns the wallet into attacker code that keeps draining every future deposit. One let them in, the other made it catastrophic. When I was younger I studied Mitnick obsessively — not to break anything, but to understand hacking on a human level. His whole point: you don't beat the crypto, you beat the person, the process, the one endpoint with access. Thirty years later, $6.3B, same lesson. And that's the whole thing. Every one of these traces back to a human or a known endpoint sitting in the control path. The fix isn't better humans — it's removing the human-shaped single point entirely. No one person who can sign. No one machine you can phish. No named party you can subpoena. The tech enforces the rules; nobody can override it; the operators are anonymous and distributed, so there's no "guy with access" to compromise and no one to lean on. You can't social-engineer a system that gave no human unilateral power. The "recovery" this week? ~$3B frozen — by centralized issuers, USDC, USDT, a chain's security council. Not a decentralization win. Centralization doing what it's good at. But decentralized isn't inherently helpless. A truly decentralized network could freeze on a permissionless trigger, even revert only the malicious txs and nothing else. That system doesn't exist yet — or some of us are quietly building it. Security is the product. Anonymous, decentralized, with the tech holding the rules and no single point to break — that's not an ideology. It's the only architecture this hack couldn't have touched.