Tag: DEFI HACK

DeFi Platform Raft Compromised, Loses $3.3 Million in Ether

by Blockchain News

A massive security breach recently occurred on the DeFi platform known as Raft, which resulted in the theft of around $3.3 million worth of Ether (ETH). The fact that the hacker was able to effectively remove 1,577 ETH from the network demonstrates the continued difficulties with security that exist inside the DeFi ecosystem.

The hacker did something quite unusual and transferred 1,570 ETH to a burn address, which basically rendered the bulk of the stolen assets useless. In sharp contrast to the significant sum that had been stolen in the beginning, the attacker was left with just seven ETH after this. This peculiar behavior led to the hacker suffering a loss, despite the fact that he or she had previously been paid 18 ETH by means of a crypto mixer service in order to allegedly finance the assault.

After the assault, the value of the dollar-pegged stablecoin known as Raft’s R plummeted dramatically, falling by fifty percent relative to its previous level. After some time had passed, it had partly recovered to around 70 cents. Raft’s co-founder, David Garai, has said that the assault and its consequences for the platform are true. Raft is now concentrating its efforts on compensating impacted users by using the sDAI that is controlled by the protocol inside the Peg Stability Module. This move was made in an attempt to limit the extent of the harm.

The issue with the Raft is not an uncommon occurrence in the crypto space. A number of high-profile assaults on Defiant platforms have taken place during the last several months. For example, a well-known cryptocurrency exchange called Poloniex had its hot wallet compromised, resulting in a loss of around $114 million in bitcoin. A breach that cost CoinEx $54 million, a heist that cost HTX (previously Huobi Global) $7.9 million, and the Mixin Network suffering the greatest DeFi hack of 2023 with an estimated loss of $200 million owing to stolen private keys are some of the other noteworthy instances that have occurred.

As a result of these occurrences, there is a heightened awareness of the critical need for DeFi platforms to strengthen the security frameworks they have in place. Trust must be maintained within the ecosystem of decentralized finance, and one of the most important ways to do this is by protecting the user money. This episode should serve as a wake-up call for improved security processes and more diligent monitoring systems in order to forestall future occurrences of events of a similar kind.

Image source: Shutterstock

Source

Tagged : / / / / / / /

DeFi Hack Linked to North Korea

by Blockchain News

The DeFi world was rocked when Euler Finance fell victim to the biggest DeFi hack of 2023, with $197 million in funds stolen. Since then, the crypto community has been closely following the on-chain movements of the stolen funds, hoping to track down the attacker. Blockchain investigator Chainalysis recently identified that 100 ETH from the stolen funds was transferred to an address linked to North Korea.

The hacker responsible for the Euler Finance hack also transferred 3,000 ETH to Euler’s deployer account without disclosing their intent. However, no other transfers have been made at the time of writing, leaving many in the crypto community speculating whether the hacker was trolling or if they genuinely considered accepting Euler Finance’s bounty reward of $20 million.

While Chainalysis has linked the stolen funds to North Korea, it has also highlighted the possibility of misdirection by other hackers. It is unclear whether North Korea is actually involved in the hack or if the hacker was simply using the address to throw investigators off their trail.

The Euler Finance hack has raised questions about the security of DeFi platforms, as Euler Labs CEO Michael Bentley expressed disappointment in the hack, revealing that ten separate audits over two years had assured its security. The fact that the hacker was still able to access and steal the funds has highlighted the need for stronger security measures in DeFi platforms.

The use of DeFi platforms has skyrocketed in recent years, and the potential rewards have attracted many hackers seeking to exploit vulnerabilities in the system. This has led to an increase in DeFi hacks, with many experts calling for stronger security measures to protect investors’ funds. The Euler Finance hack serves as a reminder that even with multiple security audits, DeFi platforms are not immune to hacks, and investors should exercise caution when investing in these platforms.

Source

Tagged : / / / / /

Euler Finance hacker returns $5.4M

by Blockchain News

On March 16, Euler Finance, a decentralized finance (DeFi) protocol, announced that it had been the victim of a massive hack in which a total of $197 million was stolen. This was quickly dubbed the biggest DeFi hack of 2023 so far and sent shockwaves through the crypto community.

The hacker was able to drain the funds through a series of multiple transactions, and then used a multichain bridge to transfer the stolen funds from the Binance Smart Chain to Ethereum. The hacker then moved the stolen funds into the crypto mixer Tornado Cash, making it difficult to track the funds.

However, on March 18, there was a surprising development when the hacker reportedly returned around $5.4 million in Ether to Euler Finance’s deployer address. The funds were sent in three transactions, and it is unclear why the hacker decided to return the funds.

This is not the first time that a hacker has returned stolen funds after a high-profile hack. In 2016, the hacker who stole $55 million from the DAO returned the stolen funds, citing a “bug” in the code. It is possible that the hacker behind the Euler Finance hack had a change of heart, or was pressured to return the funds after Euler Finance announced a $1 million reward for information on the hacker’s identity.

Euler Finance has demanded that the hacker return 90% of the stolen funds within 24 hours to avoid possible jail time. It remains to be seen whether the hacker will comply with this demand, or whether the rest of the stolen funds will be returned.

The Euler Finance hack highlights the ongoing security risks in the DeFi space. DeFi protocols are designed to be open and transparent, but this also makes them vulnerable to attacks. It is important for DeFi protocols to take measures to improve their security, such as performing regular audits and implementing multi-factor authentication for user accounts. Only by doing so can DeFi protocols gain the trust of users and investors alike.

Source

Tagged : / / / / /

DeFi Platform Cream Finance Loses $26,000,000 in Hack

by Dailyhodl

The decentralized finance (DeFi) lending protocol Cream Finance (CREAM) suffered a hack that led to the loss of about $26 million in Ethereum (ETH) and AMP tokens.

Cream Finance says the platform lost 418,311,571 AMP, currently valued at $22.1 million, and 1,308 ETH, currently valued at $4.42 million, on Tuesday “by way of reentrancy on the AMP token contract.” At the time of the hack, the crypto was worth about $18 million.

ADVERTISEMENT

 

The platform paused supply and borrow on AMP to stop the exploit. AMP is a crypto asset used as collateral for stablecoin payments.

The blockchain security firm PeckShield first spotted and analyzed the hack.

“The hack is made possible due to a reentrancy bug introduced by AMP, which is an ERC777-like token and exploited to re-borrow assets during its transfer before updating the first borrow.

Specifically, in the example [transaction], the hacker makes a flash loan of 500 ETH and deposit the funds as collateral. Then, the hacker borrows 19 million AMP and makes use of the reentrancy bug to re-borrow 355 ETH inside AMP token transfer(). Then the hacker self-liquidates the borrow. The hacker repeats the above process in 17 different transactions and gains in total 5.98K ETHs (with ~$18.8 million).“

Image
Source: PeckShield/Twitter

The protocol’s native token, CREAM, is down more than 10% on the day and is trading at $161.70 at time of writing, according to CoinGecko.

This week’s hack is not the first attack on Cream Finance this year. In March, the lending platform revealed that their website had suffered a domain name system (DNS) spoofing attack which attempted to trick their users into typing their private seed phrase into a fake MetaMask wallet input box.

Attacks on DeFi protocols have been in the news in the past few weeks after Poly Network suffered a massive $643 million hack earlier this month. Poly Network, however, worked with the pseudonymous attacker, known as Mr. White Hat, and has retrieved all of the stolen funds.

Don’t Miss a Beat – Subscribe to get crypto email alerts delivered directly to your inbox

Follow us on Twitter, Facebook and Telegram

Surf The Daily Hodl Mix 

ADVERTISEMENT



 

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any loses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Featured Image: Shutterstock/zeber

Source

Tagged : / / / / / / / /

White Hat Rescue Operation Saved SushiSwap (SUSHI) from Losing $350 Million

by Btcmanager

Decentralized exchange (DEX) SushiSwap was saved from joining the long list of hacked DeFi platforms after a white hat discovered an exploit and prevented a potential $350 million theft. 

SushiSwap Rescued from Being Hack Victim

Samczsn, a research partner at venture capital firm Paradigm, prevented SushiSwap’s MISO platform from losing $350 million worth of ETH. MISO is Sushiswap’s launchpad platform for new tokens.

The BitDAO token sale which was auctioned on MISO earlier happened without a hitch. The auction raised more than 112,000 ETH ($341.7 million) from over 9200 participants. 

According to a blog post by Sam detailing the findings and rescue operation, the Paradigm researcher, upon deeper investigation, stated that he found a vulnerability in the MISO Dutch auction contract. What was initially thought to be a minor bug turned out to be a vulnerability that could enable a hacker to steal 109,000 ETH, which was valued at $350 million at the time. 

An excerpt from the blog post reads:

“To my surprise (and horror), I found that a refund would be issued for any ETH sent which went over the auction’s hard cap. This applied even once the hard cap was hit, meaning that instead of rejecting the transaction altogether, the contract would simply refund all of your ETH instead.”

Sam added:

“Suddenly, my little vulnerability just got a lot bigger. I wasn’t dealing with a bug that would let you outbid other participants. I was looking at a 350 million dollar bug.”

Sam had to contact his colleagues at Paradigm Georgios Konstantopoulus and Dan Robinson, who in turn alerted SushiSwap’s chief technology officer (CTO), Joseph Delong, to the danger. Duncan Townsend, CTO of bug bounty platform Immunefi, and Mitchell Amador, the company’s founder and CEO were also involved in the rescue operation. 

No Funds Lost

After some deliberation, it was decided that the BitDAO team in charge of the raise would purchase the remaining auction, thereby immediately concluding the process and forestalling any threats. 

The rescue operation happened in under five hours and the team was able to prevent a potential hacker from draining over 100,000 ETH from the contract.

Meanwhile, SushiSwap, in a separate blog post, confirmed that no funds were lost, adding that:

“All future planned auctions utilizing the specific dutch auction contracts with ETH commitments have been paused until an updated version is redeployed.”

The latest development comes shortly after the DeFi protocol Poly Network suffered a massive attack. As previously reported by BTCManager, a hacker exploited a vulnerability in the protocol and stole over $600 million in tokens. 

However, the anonymous hacker referred to as “Mr White Hat” returned most of the funds. The platform later relaunched with a bug bounty program, having a total pool of $500,000 to reward white hats who detect and report bugs in its smart contract.

Related posts:






Like BTCMANAGER? Send us a tip!

Our Bitcoin Address: 3AbQrAyRsdM5NX5BQh8qWYePEpGjCYLCy4


Source

Tagged : / / / / /

THORChain (RUNE) Suffers Fresh $8 Million Hack

by Btcmanager

THORChain (RUNE) has suffered another heist in the space of one week. The hackers succeeded in stealing $8 million worth of crypto assets from the decentralized exchange and have suggested a 10 percent bounty, according to a Twitter thread on July 23, 2021.

THORChain Targeted Again

Barely seven days after THORChain, a cross-chain decentralized finance protocol suffered a $7.6 million attack, the platform has been targeted again by hackers but this time, $8 million has been stolen from the decentralized exchange (DEX).

According to a Twitter thread by the THORChain team, the latest $8m hack on its ETH Router seems to have been orchestrated by a whitehat hacker, as the perpetrators deliberately limited the impact of the heist, while also advising the team to implement a 10 percent bounty.


The hacker’s note in the transaction input data reads:

“Could have taken ETH, BTC, LYC, BNB, and BEP20s if waited. Wanted to each [a] lesson on minimizing damage. Multiple critical issues. A 10 percent VAR bounty would have prevented this. Disable [chain] until audits are complete. Audits are not nice to have. Do not rush code that controls 9 figures.”

More Work Needed 

While the THORChain team has been working round the clock to patch the bugs in the protocol since the first attack, the latest heist has indeed made it clear to the team that their hard work is not just enough. 

Against that backdrop, the team has made it clear that it plans to implement the 10 percent bug bounty program requested by the hacker, and it will also halt support for ETH until it is extensively peer-reviewed. 

“It is a tough time for the community and project, and the pain is real. The treasury has the funds to cover, but it’s time to slow down. THORChain is too important not to deliver on. The complexity of the state machine is its Achilles heel, but this can be solved with more eyes on, as well as a rethink in developer procedures and peer-review,” the team added.

While hacks and heists are seemingly inevitable in the world of decentralized finance (DeFi), a good number of projects have somehow managed to stay safe through juicy bug bounty programs and more. 

THORChain faithful have encouraged the team to look beyond audit and security firms in their efforts to solidify the network and find a way of attracting these anonymous and sophisticated hackers to work with THORChain.

At press time, the price of THORChain’s s RUNE token is down by 17 percent in the past 24 hours, trading around $3.89, according to CoinMarketCap.

Related posts:






Like BTCMANAGER? Send us a tip!

Our Bitcoin Address: 3AbQrAyRsdM5NX5BQh8qWYePEpGjCYLCy4


Source

Tagged : / / / / /

Belt Finance to Compensate Users Following $6.3 Million Attack

by Btcmanager

In recent days, the Binance Smart Chain network has been a hotspot for flash loan attacks. There have been multiple attacks on popular liquidity protocols like PancakeBunny and Bogged Finance, resulting in losses worth millions of dollars. The latest victim has been Belt Finance, another BSC-based lending protocol that lost $6.3 million in a series of transactions that manipulated the system.

Belt Finance Shares Compensation Plan

The Rekt Blog, in a post mortem on the exploit, referred to it as “another notch in the now-famous flash loan exploit season on the BSC.”

However, the project has announced a compensation plan, which is intended especially for users who had funds in the 4Belt pool or beltBUSD vault, both of which were targeted by the attack. BELT token holders would also be compensated since its price dumped 54% following the attack.

“The price of the BELT token is a direct reflection of the value of Belt Finance as a protocol, and while BELT may not be a part of our 4Belt pool, it is representative of the faith our users have vested in us.”

The first phase in the compensation plan is to take a snapshot of the 4Belt pool and 4BELT token holder addresses. They will receive remedy4BELT (r4BELT) tokens in proportion to their pre-attack holdings.

According to the blog, these new tokens can be utilized to acquire further compensation over time. Users will need to deposit new tokens alongside existing ones on PancakeSwap in order to get liquidity provider tokens, which must then be staked back into the network, implying that compensation must be effectively earned.

It was also indicated that 67 percent of the team’s unlocked allocation would be transferred to r4BELT compensation, equating to 864 tokens every day. In addition, the team will also donate $3 million USD to establish a new BELT buyback fund. PancakeSwap’s initial public offering will raise $1.5 million.

The Attack

The attack on Belt Finance caused losses of over six million dollars. The attacker leveraged Pancakeswap to carry out its plan, manipulating its belt/BUSD pool, a protocol-wide stable coin, and profiting from its inefficiency. According to the Belt Finance team’s post mortem analysis, the attackers exploited this vulnerability eight times before it was spotted.

Belt Finance’s team promptly halted withdrawals and deposits to the impacted pools, claiming that the attack vector had been addressed following the attack.

Related posts:






Like BTCMANAGER? Send us a tip!

Our Bitcoin Address: 3AbQrAyRsdM5NX5BQh8qWYePEpGjCYLCy4


Source

Tagged : / / / /

$50M reportedly stolen from BSC-based Uranium Finance

by Cointelegraph

Uranium Finance, an automated market maker platform on the Binance Smart Chain has reported a security incident that resulted in a loss of about $50 million.

Tweeting on Wednesday, Uranium revealed that the exploit targeted its v2.1 token migration event and that the team was in contact with the Binance Security Team to mitigate the situation.

The hacker reportedly took advantage of bugs in Uranium’s balance modifier logic that inflated the project’s balance by a factor of 100.

This error reportedly allowed the attacker to steal $50 million from the project. As of the time of writing, the contract created by the hacker still holds $36.8 million in Binance Coin (BNB) and Binance Dollar (BUSD).

The remaining stolen funds include 80 Bitcoin (BTC), 1,800 Ether (ETH), 26,500 Polkadot (DOT), and 5.7 million Tether (USDT) as well as 638,000 Cardano (ADA) and 112,000 u92, the project’s native coin.

Details from BSCscan show the attacker swapping the ADA and DOT tokens for ETH, upping the Ether stash to about 2,400 ETH.

Meanwhile, the alleged mastermind of the theft has already moved 2,400 ETH, worth about $5.7 million using the Ethereum privacy tool Tornado Cash.

Data from Ethereum chain monitoring service Etherscan shows the funds moving in 100 ETH sums with the cross-chain decentralized exchange bridge AnySwap used to migrate funds from BSC to the Ethereum network.

Source: Etherscan

According to Uranium, the project has reached out to the Binance Security team to prevent the hacker from moving more funds out of the BSC ecosystem.

Binance not immediately respond to Cointelegraph’s request for comment. Uranium declined to comment.

Wednesday’s hack is the second attack on the Uranium project in quick succession. Earlier in April, hackers exploited one of the platform’s pools stealing about $1.3 million worth of BUSD and BNB.

Indeed, the incident led to the first migration to v2 less than two weeks ago. In a previous announcement, the Uranium dev team said that multiple entities had audited its v2 contracts and that it had learned from its previous mistakes.

Meanwhile, speculation is rife as to whether the attack was an inside job given the sudden decision to engineer another version upgrade barely 11 days after completing the v2 migration.

Hacks associated with smart contract bugs are commonplace within the decentralized finance arena even for fully audited projects as was the case with MonsterSlayer Finance earlier in April. Back in March, Meerkat, a Yearn Finance clone on the BSC reportedly “exit-scammed” its users, stealing $31 million in the process.

Days later the project’s dev team revealed the alleged “rug pull” was a test while outlining plans to return the funds. TurtleDex, another BSC-based project also exit-scammed shortly after its launch, draining over 9,000 BNB tokens raised during the pre-sale.