# Let's Learn from the Odin.fun Hack - Preventing Attack Vectors

**URL:** https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848
**Category:** Developers
**Tags:** Discussing
**Created:** [April 15, 2025, 4:41am UTC](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848 "2025-04-15T04:41:10Z")
**Posts on this page:** 1
**Showing post:** 53

<div class="post-metadata">

### Author: ![marc0olo](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/marc0olo/32/17290_2.png) [@marc0olo](https://forum.dfinity.org/u/marc0olo)
#### Post date: [April 20, 2025, 8:26am UTC](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848/53 "2025-04-20T08:26:24Z")

</div>

> [@josephgranata](#):
>
> That said, there is a gap in docs that directly address how to prevent HACKS.

what is the concrete gap you see that should be filled? all DFINITY can really do is provide best practices. I am sure that if it makes sense to add, the security team will be happy to provide better docs.

> [@josephgranata](#):
>
> but the focus on token security I have not seen anywhere. Will DFINITY start this? Or is all up to us?

I still do not understand what exactly you mean if you talk about “token security”, please elaborate a bit more. as @skilesare already pointed out, the hack on Odin had nothing to do with ICRC-1.

> [@yongsxyz](#):
>
> I agree that the use of Internet Identity should remain the primary standard, especially in applications involving user assets.

I am not sure if I agree here. of course Internet Identity is an awesome way to integrate user authentication into a dapp, still the dapp should be free to decide what authentication method to choose. in case of Odin it was SIWB which had a serious bug that could be exploited ☹

however, when it comes to storing assets and actually using (ICRC-1) assets on ICP across different applications, then it might be better to store these in a separate wallet/signer (e.g. OISY) and handle token related activities with the [signer-standard](https://github.com/dfinity/wg-identity-authentication/blob/main/topics/signer_standards_overview.md#ic-signer-standards-overview) which is being adopted by many DeFi related dapps as we speak. please note that you could still use II for authentication/login and then request to access funds from another wallet/signer only for token related activities.

Björn actually provided his point of view in a relevant post here in the forum back in November: [PoV: Do not use ICRC-28 for Defi](https://forum.dfinity.org/t/pov-do-not-use-icrc-28-for-defi/37537)

And again, this is still not at all related to what happened to Odin.

---

_[View the full topic](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848)._