Sjors on Nostr: And they would not have used an API to gather information. Plenty of time to set up ...

And they would not have used an API to gather information. Plenty of time to set up such infrastructure locally.

You can't have someone sophisticated enough to hide underhanded C in a sloppy commit for give years, have that much patience, yet not rug everyone at once.

The game theory just doesn't work: anyone else could have found the bug in the mean time, and their sweep would come as a total surprise to the original exploiter.

A well prepared rug pull by the founders would have had to continuously maintain multiple alternative sweep transactions, in order to fee bump whatever a surprise third party attacker was doing.

I would also expect an attacker with five years of preparation to have immediately coinjoined, spread the loot across utxos and quickly exit some of it.

They would have keep to these logistics secret too for years, yet spend time continuously maintaining it, not accidentally revealing expertise in this, etc.

That's why I consider this a classic conspiracy theory. People look for supporting evidence and clues, assume an all powerful "they", and then either ignore practical logistics like I describe above, or come up with another complicated explanation how that could be avoided.

Meanwhile the simpler explanations remain: some 15 year old in his bedroom with an LLM, someone with a bit more expierence in hacking, or even the North Korea crew that wants a break from hacking shitcoin smart contracts. All of them would simply take the money as quickly as they can. The latter two would realize that people will notice the attack, so they have to make a big sweep first. And that someone else might find the bug too, or even that their LLM provider was eavesdropping and might rat them out, so they can't prepare a total sweep.