DAOUSDT
DAO Maker / Tether USD
cryptoComposite

# Key Points Discussed * The ETC Grants DAO’s [**Code is Law creative challenge**](https://x.com/ETCGrantsDao/status/2111102365801787745) wrapped up, with winners picked by engagement and prizes from 5 ETC down to 2 ETC. Kevin is reusing some of the entries for u/eth_classic. * Kevin published his first [ethereumclassic.org](http://ethereumclassic.org) post, [**Run Your Own ETC Node, Part 1: Build core-geth from Source**](https://ethereumclassic.org/blog/2026-10-15-run-your-own-etc-node-part-1-build-core-geth-from-source), the first of a three-part beginner series. Diego explained why building from source guards against supply-chain attacks, and how the stable [Argos v1.12.23](https://github.com/etclabscore/core-geth/releases/tag/v1.12.23) release differs from `master`. * There is no new core-geth release yet. The unreleased v1.12.24-unstable on `master` is mostly a [Go toolchain update](https://github.com/etclabscore/core-geth/pull/702), with no consensus changes. A pool’s [`miner_getWorkFor` pull request](https://github.com/etclabscore/core-geth/pull/704), which lets one node hand out work for any coinbase, is under review. * Back from [TOKEN2049](https://classix.dev/reflections-on-token2049), Istora and Diego covered [Justin Drake’s “bunker mode”](https://x.com/drakefjustin/status/2107837081313505768) warning that AI-assisted mathematics could break ECDSA before Q-Day. Diego explained moving funds to fresh, never-signed addresses, and Istora urged holders not to panic and to migrate methodically. * Using the new BigQuery dataset, Istora shared [how much ETC sits behind exposed public keys](https://classix.dev/etc-key-exposure), with the DAO hacker’s 3.36 million ETC the most exposed balance. Because proof of work is hash-based, only ETC’s execution layer would need to migrate, which the group saw as a strong position compared with proof-of-stake chains, and hash-based signatures as the likely long-term path. * [ETC is back in Google BigQuery](https://classix.dev/etc-in-bigquery). Kevin uses it for network stats, which show activity and hashrate rising since an August low, and used it with [btcrecover](https://github.com/3rdIteration/btcrecover) to recover a seed phrase with missing words. * Alex of [ETCMC v2](https://www.etcmc.xyz/) joined his first call. He said he was approached to run the alternative client and refused, and called the [rogue core-geth release](https://classix.dev/260916-rogue-core-geth-release) a “heist”. Istora said no miners have adopted it. * There will be an [**Ethereum Classic meetup in Mumbai**](https://luma.com/flt0wvtq) on 2 November, after the [Ethereum Cypherpunk Congress](https://congress.web3privacy.info/) and before Devcon. * Kevin asked about TOKEN2049 takeaways: [preconfirmations](https://forum.zcashcommunity.com/t/private-preconfs-above-and-beyond-25s/57653) for instant merchant payments on proof of work, native rather than bridged stablecoins, talks with [Fireblocks](https://www.fireblocks.com/) about supporting ETC, and trustless ZK bridges. Teasers for next call: ETCHD, and something related to OpenTimestamps on ETC. **Join the community calls! These calls are integral to the project and the more people that join the better! We've changed the times to fit more people during the N.A. times. So please join!** 😃

Short answer: not really. With 4 of the 5 needed signatures sitting at one company, the actual security model was "trust Sky Mavis plus one extra key", and the leftover DAO allowlist quietly turned it into just "trust Sky Mavis". Counting validators tells you a lot less than counting independent organizations and how many of them would have to be compromised at once. It also wasn't a one-off. Harmony's Horizon bridge lost about $100M in June 2022 with a 2-of-5 multisig, and that one was pinned on Lazarus too. Same pattern: a small signer set, with keys on machines a phishing campaign can reach. Ronin's own fix afterwards was raising the threshold from 5 of 9 to 8 of 11, which helps, but the part of your write-up that stands out more is the monitoring 🔍 Six days without anyone noticing 173,600 ETH leave is worse than the multisig math. When I look at a bridge now I check three things: how many separate entities hold signing keys, whether large withdrawals have a delay or rate limit, and whether temporary permissions like that allowlist ever get reviewed after they're granted.