DAOUSDT
DAO Maker / Tether USD
cryptoComposite

# Key Points Discussed * The ETC Grants DAO’s [**Code is Law creative challenge**](https://x.com/ETCGrantsDao/status/2111102365801787745) wrapped up, with winners picked by engagement and prizes from 5 ETC down to 2 ETC. Kevin is reusing some of the entries for u/eth_classic. * Kevin published his first [ethereumclassic.org](http://ethereumclassic.org) post, [**Run Your Own ETC Node, Part 1: Build core-geth from Source**](https://ethereumclassic.org/blog/2026-10-15-run-your-own-etc-node-part-1-build-core-geth-from-source), the first of a three-part beginner series. Diego explained why building from source guards against supply-chain attacks, and how the stable [Argos v1.12.23](https://github.com/etclabscore/core-geth/releases/tag/v1.12.23) release differs from `master`. * There is no new core-geth release yet. The unreleased v1.12.24-unstable on `master` is mostly a [Go toolchain update](https://github.com/etclabscore/core-geth/pull/702), with no consensus changes. A pool’s [`miner_getWorkFor` pull request](https://github.com/etclabscore/core-geth/pull/704), which lets one node hand out work for any coinbase, is under review. * Back from [TOKEN2049](https://classix.dev/reflections-on-token2049), Istora and Diego covered [Justin Drake’s “bunker mode”](https://x.com/drakefjustin/status/2107837081313505768) warning that AI-assisted mathematics could break ECDSA before Q-Day. Diego explained moving funds to fresh, never-signed addresses, and Istora urged holders not to panic and to migrate methodically. * Using the new BigQuery dataset, Istora shared [how much ETC sits behind exposed public keys](https://classix.dev/etc-key-exposure), with the DAO hacker’s 3.36 million ETC the most exposed balance. Because proof of work is hash-based, only ETC’s execution layer would need to migrate, which the group saw as a strong position compared with proof-of-stake chains, and hash-based signatures as the likely long-term path. * [ETC is back in Google BigQuery](https://classix.dev/etc-in-bigquery). Kevin uses it for network stats, which show activity and hashrate rising since an August low, and used it with [btcrecover](https://github.com/3rdIteration/btcrecover) to recover a seed phrase with missing words. * Alex of [ETCMC v2](https://www.etcmc.xyz/) joined his first call. He said he was approached to run the alternative client and refused, and called the [rogue core-geth release](https://classix.dev/260916-rogue-core-geth-release) a “heist”. Istora said no miners have adopted it. * There will be an [**Ethereum Classic meetup in Mumbai**](https://luma.com/flt0wvtq) on 2 November, after the [Ethereum Cypherpunk Congress](https://congress.web3privacy.info/) and before Devcon. * Kevin asked about TOKEN2049 takeaways: [preconfirmations](https://forum.zcashcommunity.com/t/private-preconfs-above-and-beyond-25s/57653) for instant merchant payments on proof of work, native rather than bridged stablecoins, talks with [Fireblocks](https://www.fireblocks.com/) about supporting ETC, and trustless ZK bridges. Teasers for next call: ETCHD, and something related to OpenTimestamps on ETC. **Join the community calls! These calls are integral to the project and the more people that join the better! We've changed the times to fit more people during the N.A. times. So please join!** 😃

Short answer: not really. With 4 of the 5 needed signatures sitting at one company, the actual security model was "trust Sky Mavis plus one extra key", and the leftover DAO allowlist quietly turned it into just "trust Sky Mavis". Counting validators tells you a lot less than counting independent organizations and how many of them would have to be compromised at once. It also wasn't a one-off. Harmony's Horizon bridge lost about $100M in June 2022 with a 2-of-5 multisig, and that one was pinned on Lazarus too. Same pattern: a small signer set, with keys on machines a phishing campaign can reach. Ronin's own fix afterwards was raising the threshold from 5 of 9 to 8 of 11, which helps, but the part of your write-up that stands out more is the monitoring 🔍 Six days without anyone noticing 173,600 ETH leave is worse than the multisig math. When I look at a bridge now I check three things: how many separate entities hold signing keys, whether large withdrawals have a delay or rate limit, and whether temporary permissions like that allowlist ever get reviewed after they're granted.

Yeah, it’s based on the security exchange act, the exchange act, and the DAO report, and the supreme courts application of the Howey test… [You should read it](https://www.cftc.gov/sites/default/files/2026/03/2026-05635a.pdf) there is one really interesting bit right at the end though..Michael Selig is both the only appointed commissioner currently at the CFTC, AND the acting chairman… ”on this matter, Chairman Selig voted in the affirmative. No commissioner voted in negative.” this document isn’t worth pissing on…

**Fun fact with bad timing:** in April 2022, Binance led the $150M round that went toward paying back Ronin's users after the hack. On Oct 31, the FBI said North Korea was behind the more than $6B that just left Binance itself. Ronin is still the cleanest example of how this keeps working. Most people remember it as "one guy opened a fake job offer." The company's own postmortem tells a longer story. **The setup** * Ronin was Axie Infinity's own chain. Money crossed over a bridge run by **9 validators, and any 5 signatures could approve a withdrawal.** * Sky Mavis, the studio behind Axie, ran **4 of the 9.** * Why only 5? Their own Q&A: some nodes "didn't catch up with the chain, or were stuck in syncing state." **The favor nobody switched off** * Nov 2021: the network was getting hammered, so Sky Mavis asked the Axie DAO for help handing out free transactions. The DAO allowlisted Sky Mavis to sign on its behalf. * Dec 2021: the arrangement ended. Their words: "the allowlist access was not revoked." * So signature #5 was still reachable from inside Sky Mavis. **The drain** * The Block later reported (two anonymous sources) that a senior engineer got a fake job offer after several rounds of interviews, sent as a PDF. Sky Mavis declined to comment on how it happened. Its postmortem only says "one employee was compromised." * Mar 23, 2022: two withdrawals, **13:29:09 and 13:31:04 UTC. 115 seconds apart.** 173,600 ETH and 25.5M USDC, about $625M. * Nobody noticed for **six days.** Their words: "We didn't have a proper tracking system for monitoring large outflows from the bridge." The alarm was a user who couldn't withdraw 5,000 ETH. **The part I keep thinking about:** users were paid back in coins. ETH had dropped so much by the time the bridge reopened in June that the refund was worth about $216.5M. And the Axie DAO, the group that did the favor, didn't get its own 56,000 ETH covered in that refund. Question for people who know bridges better than me: **is a 5-of-9 multisig with 4 keys at one company decentralized in any real sense?** And how many bridges today look the same if you squint? I made a 14 minute doc on the whole chain (the FBI naming Lazarus, the money going through mixers, the roughly 10% that got seized back) for a small channel I started a few weeks ago. Sources are on screen the whole way. If you want the full story with the visuals: [https://www.youtube.com/watch?v=63\_InzH4fO4](https://www.youtube.com/watch?v=63_InzH4fO4) Honest feedback welcome, I'm still learning this.