Tag: Hacker

Mixin Network Urges Hacker to Return Funds, Offers $20M Bug Bounty

by Blockchain News

Key Takeaways

  1. Mixin Network was hacked, resulting in a loss of $200 million in user assets.

  2. The company has left a message for the hacker, offering a $20M bug bounty for the return of the assets.

  3. The transaction was confirmed on block 18225451, with a timestamp of Sep-27-2023 06:55:59 AM +UTC.

Mixin Network, a Hong Kong-based decentralized cross-chain transfer protocol, suffered a significant security breach on September 23, 2023. The hack led to an estimated loss of $200 million in assets, primarily in Bitcoin. The company immediately suspended deposits and withdrawals but maintained that intra-network transfers would remain operational. Before the incident, Mixin had nearly $400 million across 48 chains locked in its protocol, according to data provided by DefiLlama.

The Message to the Hacker

In an unprecedented move, Mixin Network has communicated directly with the hacker via a transaction message. The message reads, “Most of our platform assets were users’, and we hope you can refund them. You can keep $20M of the assets as a BUG Bounty Reward for the BUG. Contact us via bug@mixin.one for the reward details.” The transaction was confirmed on block 18225451, with a timestamp of Sep-27-2023 06:55:59 AM +UTC. The transaction fee was a mere 0.00016736127846444 ETH, equivalent to $0.27.

Background Investigations and Exchange Involvement

Cybersecurity watchdog Cyvers Alerts has been investigating the incident and revealed that two hacker addresses received 51 ETH from an account that had previous interactions with major cryptocurrency exchanges Huobi Global and Binance. The watchdog has called on these exchanges to assist in identifying the account linked to the suspicious transactions. Blockchain security firm SlowMist has also been enlisted to assist in the ongoing investigation. The involvement of these major exchanges could be crucial in tracing the origins of the funds and possibly recovering some of the stolen assets.

Controversies and Community Reactions

The hack has sparked debates and controversies within the crypto community. Zhuoer Jiang, CEO of Bitcoin mining pool BTC.TOP, claimed that Bitcoin stored in the Mixin protocol “should have never been stolen in the first place” and should have been “kept in cold storage.” Mixin founder Xiaodong Feng announced that the company would compensate users “up to a maximum of 50%” for the stolen assets. The remainder would be distributed to users as “tokenized liability claims” that Mixin would eventually repurchase “with its future profits.”

The Larger Implications

The Mixin Network hack serves as a stark reminder of the vulnerabilities that exist within the cryptocurrency ecosystem. Cyvers Alerts emphasized the need to strengthen cybersecurity measures to prevent future incidents of this nature. The incident has sparked concern in the crypto community, given the recent spate of similar hacks.

Disclaimer & Copyright Notice: The content of this article is for informational purposes only and is not intended as financial advice. Always consult with a professional before making any financial decisions. This material is the exclusive property of Blockchain.News. Unauthorized use, duplication, or distribution without express permission is prohibited. Proper credit and direction to the original content are required for any permitted use.


Image source: Shutterstock

Source

Tagged : / / / / / / / / / /

Euler Finance Hacker Returns Stolen Funds

by Blockchain News

On March 13, 2023, Euler Finance suffered a flash loan attack, resulting in the theft of $196 million worth of various tokens, including Dai, USDC, StETH, and WBTC. This attack drained millions of dollars from Euler Finance’s smart contracts, causing the total value locked inside them to drop from over $311 million to $10.37 million. Additionally, 11 different DeFi protocols, including Balancer, Yearn.finance, and Yield Protocol, either froze or lost funds.

Following the attack, Euler Finance took proactive measures to recover the stolen funds. The protocol disabled its vulnerable etoken module and donation function as the first course of action and worked with auditing companies to analyze the root cause of the exploit. At the same time, Euler Finance attempted to contact the hacker to negotiate a bounty.

On March 15, Euler Finance gave the hacker an ultimatum to return 90% of the stolen funds or face a $1 million reward for information leading to their arrest. The hacker, however, started moving funds at will, causing chaos and distress among the victims. Despite this, one victim managed to convince the hacker to return their life savings, resulting in the hacker beginning to return stolen funds over several days.

Meanwhile, Euler Finance’s CEO, Michael Bentley, revealed that ten separate audits over two years deemed the protocol “nothing higher than low risk” with “no outstanding issues.” However, the hack exposed the protocol’s vulnerability and the need for improved security measures.

On March 21, Euler Finance launched a $1 million bounty reward against the hacker after being ghosted mid-conversation while trying to strike a deal. However, the hacker started returning the stolen assets in large numbers on multiple occasions, starting on March 25. Finally, 23 days after the hack, Euler Finance announced that the stolen funds had been recovered, and the $1 million bounty was no longer accepting new information.

In the final transactions, the hacker returned 12 million DAI and 10,580 ETH in multiple transactions. The crypto community applauded Euler Finance’s efforts to recover the funds and restore investor confidence. Gnosis, the team behind Gnosis Safe multisig and Gnosis Chain, recently launched a hash oracle aggregator to improve the security of bridges by requiring more than one bridge to validate a withdrawal.

The Euler Finance hack serves as a cautionary tale for the DeFi industry, highlighting the importance of comprehensive security measures and frequent audits. It also demonstrates the benefits of negotiating with hackers to recover stolen funds and the role of the community in restoring investor confidence. Overall, the recovery of the stolen funds is a significant victory for Euler Finance and the DeFi industry as a whole.

Source

Tagged : / / / / /

Euler Finance Hacker Returns Majority of Stolen Funds

by Blockchain News

In a dramatic turn of events, the hacker behind the $196 million exploit on the lending protocol Euler Finance has returned the majority of the stolen assets. According to on-chain data, on March 25th, the exploiter returned 51,000 ETH and 7,737 ETH worth over $101 million at the time of writing. The hacker had previously sent 3,000 ETH to the protocol on March 18th, worth nearly $5.4 million at the time. However, the exploiter still controls some of the stolen assets.

The Euler Finance hack took place on March 13th, when the hacker carried out multiple transactions, stealing nearly $196 million from the protocol in a flash loan attack. This attack is considered the largest decentralized finance (DeFi) hack of 2023. The stolen assets included 8.8 million Dai (DAI), 849,000 Wrapped Bitcoin (WBTC), 85 million Staked Ether (stETH), and 34 million USD Coin (USDC).

After a few days, the hacker sent an on-chain message to Euler Finance, calling for an agreement with the protocol. In the message, they stated that they had “no intention of keeping what is not ours” and that they wanted to make things easy on those affected. The protocol had previously tried to negotiate with the exploiter, requesting that they return 90% of the stolen funds within 24 hours or face legal action. However, no response was received, and Euler Finance offered a $1 million bounty reward for any information leading to the capture of the exploiter.

The hacker has made other transactions, including a transfer of 1,000 ETH Smart Staking (NETH) worth approximately $1.65 million at the time, through sanctioned crypto mixer Tornado Cash. However, blockchain analytics firm PeckShield reported that around 100 ETH was sent to a wallet address likely owned by one of the victims. An on-chain message sent by the wallet address had earlier pleaded for the attacker to return their “life savings.”

The return of the majority of the stolen funds is good news for Euler Finance and its users, but the incident highlights the need for better security measures in the DeFi space. Despite the growing popularity of DeFi, the industry remains vulnerable to hacks and exploits. The Euler Finance hack is just the latest in a series of high-profile attacks on DeFi protocols, and it is a stark reminder that investors must remain vigilant and cautious when participating in DeFi.

Source

Tagged : / / / / /

DeFi Hacker Returns $5.4M to Euler Finance

by Blockchain News

On March 18, Euler Finance, a decentralized finance (DeFi) platform, received a surprising gift from the hacker who had drained $197 million from the platform just a few days earlier. The attacker returned 3,000 ETH ($5.4 million) to Euler Finance’s deployer address, citing a change of heart.

The attack on Euler Finance, which occurred on March 15, was one of the biggest DeFi hacks of 2023 so far. The attacker was able to drain $197 million through multiple transactions and later used a multichain bridge to transfer the funds from the Binance Smart Chain (BNB) to Ethereum. The stolen funds were then moved into Tornado Cash, a crypto mixer that anonymizes transactions.

In response to the hack, Euler Finance announced a $1 million reward to anyone who could help track down the hacker and retrieve the funds. The platform also demanded that the hacker return 90% of the funds within 24 hours to avoid possible jail time.

It is unclear why the hacker returned the funds, but it may have been due to the pressure from the $1 million bounty or the fear of getting caught. This is not the first time a DeFi hacker has returned stolen funds. In July 2022, the attacker who stole $600 million from Poly Network returned the funds and even received a job offer from the company.

DeFi hacks are becoming more common as the industry grows and attracts more attention from hackers. According to CipherTrace’s 2023 DeFi Decentralized Exchange (DEX) Report, DeFi hacks have already surpassed $1 billion in 2023. To prevent such attacks, DeFi platforms are investing in better security measures and insurance policies.

The return of the funds to Euler Finance may come as a relief to the platform and its users, but it also highlights the need for better security measures in the DeFi industry. As the industry continues to grow and mature, it is likely that we will see more hacks and exploits, but hopefully, we will also see more successful recoveries and stronger security measures.

Source

Tagged : / / / /

Euler Finance hacker returns $5.4M

by Blockchain News

On March 16, Euler Finance, a decentralized finance (DeFi) protocol, announced that it had been the victim of a massive hack in which a total of $197 million was stolen. This was quickly dubbed the biggest DeFi hack of 2023 so far and sent shockwaves through the crypto community.

The hacker was able to drain the funds through a series of multiple transactions, and then used a multichain bridge to transfer the stolen funds from the Binance Smart Chain to Ethereum. The hacker then moved the stolen funds into the crypto mixer Tornado Cash, making it difficult to track the funds.

However, on March 18, there was a surprising development when the hacker reportedly returned around $5.4 million in Ether to Euler Finance’s deployer address. The funds were sent in three transactions, and it is unclear why the hacker decided to return the funds.

This is not the first time that a hacker has returned stolen funds after a high-profile hack. In 2016, the hacker who stole $55 million from the DAO returned the stolen funds, citing a “bug” in the code. It is possible that the hacker behind the Euler Finance hack had a change of heart, or was pressured to return the funds after Euler Finance announced a $1 million reward for information on the hacker’s identity.

Euler Finance has demanded that the hacker return 90% of the stolen funds within 24 hours to avoid possible jail time. It remains to be seen whether the hacker will comply with this demand, or whether the rest of the stolen funds will be returned.

The Euler Finance hack highlights the ongoing security risks in the DeFi space. DeFi protocols are designed to be open and transparent, but this also makes them vulnerable to attacks. It is important for DeFi protocols to take measures to improve their security, such as performing regular audits and implementing multi-factor authentication for user accounts. Only by doing so can DeFi protocols gain the trust of users and investors alike.

Source

Tagged : / / / / /

Sky Mavis Promises to Compensate Lost Users for Ronin Hack

by Blockchain News

After hacking and stealing $625 million from the Ronin blockchain, the Singapore-based game studio Sky Mavis pledges to repay users, according to Bloomberg.

Webp.net-resizeimage - 2022-03-31T163332.372.jpg

The hackers reportedly stole around 173,600 ether and $25.5 million in Coin tokens on March 23. At current prices, the stolen funds are worth approximately $615 million. According to blockchain analytics firm Elliptic, this is the second-largest cryptocurrency hacker theft on record.

Ronin said that they are now actively recovering the stolen cryptocurrency, adding that:

“We are working directly with various government agencies to ensure the criminals get brought to justice,”

The Ronin Network has suffered what is being tagged as the largest hack in the history of Decentralized Finance (DeFi), which funds over $625 million carted away by the hackers.

Ronin Network is an Ethereum sidechain created with Axie Infinity’s community. It is the product of the search by the Axie Infinity team for a fast, cheap, and reliable network resident on the Ethereum blockchain.

A spokesperson from Sky Mavis said:

“We are committed to ensuring that all of the drained funds are recovered or reimbursed, and we are continuing conversations with our stakeholders to determine the best course of action”

Hackers used hacked private keys to create withdrawals through overlooked nodes and currently lose 173,600 ETH and $25.5 million in USDC.

Sky Mavis COO Aleksander Leonard Larsen said the stolen funds included Axie Infinity’s treasury revenue in addition to user deposits.

The total value of $3.6 billion Bitcoins disappeared while the founders of South African cryptocurrency exchange AfriCrypt are missing, Bloomberg reported last June.

Online cryptocurrency exchange Liquid Exchange was attacked by hackers and transferred approximately $80 million worth of cryptocurrency on August 19, 2021.

Image source: Shutterstock

Source

Tagged : / / / / /

Multichain hacker returns 322 ETH, keeps hefty finders fee

by Cointelegraph

In a dramatic twist, one of this week’s Multichain hackers has returned 322 ETH ($974,000 at the time of writing) to the cross-chain router protocol and one of the affected users.

However the hacker kept 62 ETH ($187,000) as a “bug bounty”, and a total of 528 ETH (worth $1.6M) remains outstanding after the exploits.

Earlier this week, news emerged of a security vulnerability with Multichain relating to the tokens WETH, PERI, OMT, WBNB, MATIC, and AVAX, and $1.43 million was stolen. Multichain announced on Jan. 17 the critical vulnerability had been “reported and fixed.”

However, publicity about the vulnerability reportedly encouraged a number of different attackers to swoop in, and more than $3 million in funds were stolen. The critical vulnerability in the six tokens still exists, but Multichain has drained around $44.5m of funds from multiple chain bridges to protect them.

One of the hackers, calling himself a “white hat” has been in communication with both Multichain and a user who lost $960,000 in the past day or so, to negotiate returning 80% of the money in return for a hefty finders fee.

According to a Jan. 20 tweet from ZenGo wallet co-founder Tal Be’ery, the hacker claimed they hadbeen “saving the rest” of the Multichain users who were being targeted by bots, in an act of defensive hacking.

The funds were returned across four transactions. On Jan. 20 the hacker returned 269 ETH ($813,000) in two transactions directly to the user he stole it from and kept a bug bounty of 50 ETH ($150,000).

The relieved user responded to the hacker:

“Well received, thank you for your honesty.”

Overnight, the hacker also returned 50 ETH ($150,000) across two transactions to the official Multichain address, and kept a bug bounty of 12 ETH ($36,000).

Related: Multichain asks users to revoke approvals amid ‘critical vulnerability’

Multichain (formerly Anyswap) aims to be the “ultimate router for Web3.” The platform supports 30 chains at the moment, including Bitcoin (BTC), Ethereum (ETH), Avalanche (AVAX), Litecoin (LTC), Terra (LUNA), and Fantom (FTM).

In a tweet on Jan. 20, the Co-Founder and CEO of Multichain Zhaojun conceded that Multichain bridge contracts need a pause function to deal with similar incidents in future..

Cointelegraph has contacted the project for comment.