Category: Hackers

Categories
Blockchain Hackers Harmony

Harmony Community Outraged by Proposal to Repay Victims of $100 Million Hack

Members of the Harmony (ONE) community have reacted angrily to a proposal from the Harmony team to reimburse victims of last month’s Horizon bridge hack in which almost US$100 million of users’ assets were stolen:

The proposed plan would see victims recompensed not from treasury funds but through the minting of billions of new ONE tokens, requiring a hard fork of the blockchain and potentially resulting in further devaluing of the token and more losses for holders.

Harmony Team Offers Two Reimbursement Options

The reimbursement proposal from the Harmony team gives community members two options, the primary difference between them being how many new tokens will need to be minted. ONE holders will have the opportunity to vote on the option they prefer, which will then be implemented by the Harmony team.

The Harmony team claims that issuing new tokens is the best way to compensate victims, explaining that paying compensation directly from the project’s treasury could endanger its very survival:

We decided against using the foundation treasury in the interest of the longevity and wellbeing of the project, as reimbursing from the treasury would greatly hinder the foundation’s ability to support the growth of Harmony and its ecosystem.

Harmony team

Under the first option, victims of the hack will be compensated for 100 percent of their losses, requiring the minting of 4.97 billion new ONE tokens. The second option is reimbursement of only 50 percent of victims’ losses, requiring the minting of 2.48 billion new tokens.

Both options would take three years to complete, with victims required to claim 1/36th of their share of tokens each month over that period. The Harmony team says a slow drip feed of tokens to victims would “prevent market disruptions from a sudden increase in supply of ONE tokens”.

Harmony’s current total token supply is 13.1 billion, meaning that by the end of the reimbursement scheme its supply will have inflated by between 19 and 38 percent.

Community Not Impressed

Unsurprisingly, the Harmony community is generally unimpressed with this proposal. Most holders are concerned about the massive inflation of supply and the effect this will have on the value of their investment:

Holders’ concerns are likely justified – for the price of ONE to grow during the three years of the proposed reimbursement scheme, it would have to overcome the injection of an additional 69 million or 138 million tokens (depending on the option) each and every month.

Categories
Crime Hackers Mining Scams Security

‘Cryptojacking’ in Financial Sector Soars 269% in 2022, Security Firm Report

A report from cybersecurity company SonicWall shows financial firms are now the main victims of so-called ‘cryptojacking’ attacks, following a 269 percent increase in the frequency of cyber-related exploits targeting the finance sector in the first half of 2022.

Cryptojacking refers to a cyber attack where a hacker uses malware to surreptitiously install crypto mining software on a victim’s computer, commandeering the computer’s resources to fraudulently mine crypto. It results in significantly degraded computer performance and high electricity costs for the victim.

Finance and Retail Sectors are Major Targets

In previous years, healthcare and education sectors had been the primary victims of cryptojacking, but that changed recently after what the report’s authors described as a “dramatic reshuffling” in 2022. 

Global cryptojacking volume increased 30 percent compared to the first half of 2021. The financial sector has borne the brunt of the massive increase and it now suffers over five times more cryptojacking attacks than the second-placed retail industry, which itself saw a 63 percent increase in attacks year-to-date.

Last year, partly in response to the number of cyberattacks against domestic businesses, the Australian federal government introduced controversial, far-reaching legislation to increase its powers in the event of a high-risk security attack.

Cryptojacking Increase Related to Fall in Ransomware Attacks

The report argues the huge growth in cryptojacking can be partly attributed to a shift away from ransomware attacks by scammers.

Unlike ransomware, which announces its presence and relies heavily on communication with victims, cryptojacking can succeed without the victim ever being aware of it.

2022 SonicWall Cyber Threat Report

“And for some cybercriminals feeling the heat, the lower risk is worth sacrificing a potentially higher payday.”

As mainstream adoption of crypto has grown, organised criminals have increasingly used the new technology to ply their illicit trade. A 2021 report from Chainalysis estimated US$33 billion had been laundered through crypto in the past five years.

Categories
Audius Hackers Illegal Tokens

Hacker Exploits ‘Audius’ for $1 Million in Malicious Governance Proposal

Decentralised music streaming platform Audius has announced that it lost around US$1 million to an unknown hacker early on July 24.

The hacker was able to gain the funds after the platform mistakenly passed a malicious governance proposal that saw more than US$6 million worth of the platform’s AUDIO tokens transferred:

The hacker was able to transfer 18 million AUDIO tokens from the community treasury, an action that was approved by the Audius community, then assigned himself as the sole guardian of the contract by calling the smart contract function “initialize()”.

Once the platform detected that attack, it paused smart contracts and AUDIO tokens initially to prevent further loss of funds but resumed smart contract functionality soon after. Funds in both the community and the foundation treasury are now said to be safe.

Slippage in AUDIO Price

The attacker sold the tokens on decentralised exchange Uniswap for US$1.08 million, triggering a slippage in the AUDIO price. Slippage refers to the difference between the expected price of a token and the price when the order executes, and is expressed as a percentage of a dollar amount.

According to a tweet from security analysis firm PeckShield, the fault is said to have been caused by inconsistencies discovered in the storage layout of Audius:

Audius Designed to Cut Out the Middleman

Audius was established to connect music fans with artists without having the need for an intermediary like a record label. Initially designed to be a blockchain version of SoundCloud, it is a place where artists can produce immutable songs that fans can listen to free of charge.

The platform gives artists the freedom to choose how they monetise their work and ensures that artists receive 90 percent of the revenues collected. The remaining 10 percent is issued to node operators. Audius has become so popular that popular music artists such as Katy Perry, Steve Aoki and the Chainsmokers have invested in the crypto-powered streaming platform.

Audius now has over six million monthly active users and is a community-owned and operated protocol. The platform recently introduced AUDIO Tipping, enabling fans to tip their favourite artists using the native AUDIO token.

Categories
Crypto News Ethereum Hackers NFTs

Hackers Make Off with $400K in ETH in PREMINT Hack

PREMINT, an NFT registration platform, has notified users via Twitter that an unknown party had stolen US$400,000 in ETH via a malicious wallet connection:

Hackers Secure Premint Bag

In this year’s most recent hack, 320 NFTs were stolen from the PREMINT site. CertiK, a blockchain security firm, analysed the situation and found that malicious JavaScript code had been utilised in the hack. This code created a pop-up within the site which prompted users to verify their wallet ownership. Despite many taking to Twitter to issue a warning, the hackers had already duped six PREMINT customers in mere minutes:

The stolen NFTs included Bored Apes, Moonbirds, and Goblintowns. Once they were obtained, the hacker sent the funds to Tornado Cash to wipe the digital trail left by blockchain transactions.

PREMINT has thanked those of its customers who have helped minimise the impact of the hack and are accumulating data on all NFTs stolen.

Other 2022 Phishing Attacks

Phishing attacks seem to be increasing in frequency this year, with multiple sizeable thefts across the end of the first quarter. A total of 35 NFTs were stolen in early April, including a Mutant and Bored Ape. The attack was carried out via several hacked verified Twitter accounts with the total stolen value exceeding US$900,000.

A month later, 29 Moonbird tokens were stolen when a malicious link wired a scammer US$1.5 million worth of Moonbird NFTs from a Proof Collective member. At the time, the Collective was working on a full report in collaboration with the FBI.

Categories
Crypto News Crypto Wallets Cryptocurrency Law Hackers NFTs

UK Court Rules That Lawsuits Can Be Served Via NFTs

In what is a legal precedent for the High Court of England and Wales, a plaintiff has been granted permission to file a lawsuit against anonymous defendants by means of an NFT drop.

The move will allow Fabrizio D’Aloia, founder of Italy-based online gaming company Microgame, to serve legal documents on people who are not known by name but connected via two digital wallets:

Joanna Bailey, an associate of Giambrone & Partners LLP who are representing D’Aloia, described the precedent as “significant” in a sector where scams and hacks can often only be tied to wallet addresses and not their actual individual owners:

This is so important because it shows the court’s willingness to adapt to new technologies and embrace the blockchain and actually step in to help consumers where previous legislation and regulators simply could not …

Joanna Bailey, associate, Giambrone & Partners LLP

D’Aloia claimed to have been lured by an online brokerage into depositing about 2.1 million USDT and 230,000 USDC into two wallets that turned out to be fraudulent. The court ruling, said Bailey, allows D’Aloia to sue those responsible for the fraudulent platform by sending court documents via an NFT drop to the two wallets.

Other Legal Firsts Involving NFTs

Such specified usage of an NFT drop follows a world-first international hacking case last month where a defendant was served with a temporary restraining order by means of an NFT.

A month earlier, the UK High Court of Justice ruled to recognise NFTs as private property, hailed as a “landmark” in the ongoing battle against fraud in the crypto space.

However, the catch in that ruling was that the conferred private property status did not extend to the underlying content represented by an NFT.

Civil Procedure Rules in the UK have previously allowed for lawsuits and legal documents to be served using Instagram, Facebook, and a contact form on a website. Until now, the only other means were via personal services, “snail” mail, dropped off at a physical address, or by sending a fax or another type of “electronic communication”.

Categories
Ethereum Hackers Uniswap

Uniswap Users Lose $8 Million in ETH in Phishing Attack

A phishing scam offering a fraudulent airdrop has this week managed to rob Uniswap users of almost US$8 million in ETH. The scam, instigated on July 11, was promising a free airdrop of 400 UNI tokens (worth about US$2,200):

The scam involved asking users to connect their crypto wallets and make the transaction to claim the fraudulent airdrop. On connection, the hacker nabbed users’ funds via a malicious smart contract.

According to data from Etherscan, more than 74,000 wallets have interacted with the phishing scam’s smart contract. A notable aspect of the attack was that the code was not verified for the smart contract deployed on Etherscan, which is something most legitimate projects do.

How the Attack Unfolded

After deployment of the smart contract, in order to collect the airdropped tokens, the hacker tricked users into signing a transaction. The transaction instead served as an approval transaction, which granted the hacker access to all the Uniswap Liquidity Pool (LP) tokens held by the user.

Uniswap creator Hayden Adams took to Twitter to reassure the community that the hack was indeed a phishing attack and was totally separate from the protocol:

Bad Timing for Uniswap

News of the attack does not come at the best time for Uniswap. The decentralised exchanged (DEX) only recently announced the acquisition of the NFT marketplace aggregator Genie and plans to integrate NFTs into its products, starting with the Uniswap web application.

While the platform is making strides in terms of expanding its reach within the Web3 space, the DEX was hit by a class-action lawsuit in April for promoting “scam coins”. The plaintiff in the case claims to have purchased around US$10,000 worth of “fraudulent” ERC-20 tokens via Uniswap between May and June of 2021.

Categories
Crypto News Hackers

Yam Finance Successfully Thwarts $3.1 Million Governance Attack

The team at DeFi protocol Yam Finance has successfully blocked an attempt to wipe out the project’s treasury, worth US$3.1 million. The would-be attacker had introduced a governance proposal that would have transferred control of Yam Finance’s reserves to the hacker’s wallet.

According to a preliminary report issued by Yam DAO, the attack was launched on July 7 but was only detected two days later:

The attacker submitted a governance proposal via internal transactions, thus making it difficult for community members to notice it. The malicious proposal included an unverified contract designed to transfer control of the platform’s reserves to a wallet address controlled by the attacker. If the exploit had succeeded, the attacker would have been able to drain Yam’s treasury.

Attacker Puts Up Native Tokens to Reach Quorum

Shortly after the proposal was created, the attacker voted on the proposal using 224,739 YAM (native tokens) – a number sufficient to reach a quorum. However, the team at Yam was able to cancel the proposal using their privileges, thus blocking the attack.

After the native token took a tumble, the YAM community voted on a “Redemption Proposal” that would have allowed token holders to redeem YAM tokens from the treasury for about US$0.25 each. The proposal was passed on July 8, with 54.14 percent of voters supporting it. Three days later, the team at Yam suggested a re-vote be taken to allow more time for discussion:

Categories
Crypto News DeFi Hackers NFTs

NFT Lender ‘Omni’ Exploited for $1.4m in Reentrancy Attack

In circumstances similar to early May’s US$80 million exploit of DeFi platform Rari Capital, NFT money market platform Omni lost 1300 ETH (about US$1.43 million) in a flash loan reentrancy attack last weekend:

According to a tweet from blockchain security firm PeckShield, the July 10 attack took the form of a hacker using NFTs from a collection called Doodles as collateral to borrow wrapped ETH (WETH). The hacker exploited the reentrancy vulnerability by withdrawing all but one of the Doodle NFTs. This triggered a malicious callback function enabling the hacker to use the borrowed funds to buy even more Doodles before liquidating the loan position.

Hacker Uses Borrowed WETH to Buy More NFTs

The remaining NFT was never going to cover the debt position, which is where the reentrancy came in – the attacker was able to use the borrowed WETH to buy more NFTs prior to liquidating the loan.

According to a statement from Omni, the exploit did not impact any customers as only internal testing funds were affected, since the platform is still in beta testing mode and has since paused all operations pending a thorough investigation:

Data from Etherscan shows the hacker has already laundered the funds via Tornado Cash. This increasingly common modus operandi was also deployed when MM.Finance, the largest DeFi exchange on Cronos, had a vulnerability in its Domain Name System exploited in May, less than a week after the Rari Capital hack.

Categories
Bitcoin Crypto News Hackers

Mt. Gox Exchange Finally To Release 150,000 BTC to Users After 8 Years

The end may finally be in sight for creditors of the infamous Mt. Gox heist. Authorities were only able to recover an estimated 150,000 of the 850,000 stolen BTC. Creditors, forced to HODL through multiple cycles have seen their stash soar in value, and now need to decide whether to take their respective proceeds in Bitcoin, Bitcoin Cash or US dollars.

Mt. Gox Recap

Mt. Gox was originally founded in 2006 as an exchange to trade “Magic: The Gathering Online” cards, hence the acronym MTGOX. In 2010, it transformed into a Bitcoin exchange to provide an easy platform for users to buy and sell BTC.

At one stage, it handled over 70 percent of all bitcoin transactions globally, however through a combination of ignorance, naivety and security mismanagement, around 850,000 BTC were stolen between 2011 and 2013, the vast majority belonging to its customers.

According to blockchain analytics firm Glassnode, the Mt. Gox stash represents 0.72 percent of total supply and 1.03 percent of long-term-holder supply:

Mt Gox supply. Source: Glassnode

For a compelling account of the entire saga, crypto analyst Miles Deutscher’s Twitter thread is well worth reading:

The End is Nigh

In October last year, the rehabilitation trustee for Mt. Gox released a formal rehabilitation plan to which 99 percent of creditors agreed. Although planned distribution of the proceeds has been somewhat delayed, an email sent by Mt. Gox trustee Nobuaki Kobayashi indicates that creditors now have an important decision.

According to Kobayashi, “rehabilitation creditors” have the following choices at their disposal:

Extract from Trustee email. MtGox.com

Twitter users joked that Bitcoin Cash was even an option:

Impact on Price Action?

Given that bitcoin is 35 times higher than it was at the time of the hack, some have argued that it would be “realistic” to expect a flood of BTC sold, resulting in further price capitulation. Others have argued the opposite, suggesting that those who bought in early are likely to have had their conviction strengthened over the years, and probably wouldn’t sell into a bear market.

Time will tell how things play out, though as Ark Invest analyst David Puell notes, 2022 has thrown the proverbial kitchen sink at Bitcoin.

If Bitcoin navigates this period as proponents expect, it is likely to emerge stronger and more antifragile on the other end:

Categories
DeFi Hackers Markets Solana

‘Crema Finance’ Hacker Returns Funds, Receives $1.7 Million in SOL as Bounty

Solana-based liquidity protocol Crema Finance claims it has recovered most of the roughly US$9 million worth of assets stolen by a hacker on July 3:

Crema Finance negotiated an agreement with the hacker, whose identity remains unknown, which allowed the hacker to keep a portion of the stolen assets as a bug bounty in exchange for returning the remaining assets.

No Criminal Charges Likely

The hack on Crema Finance resulted in the theft of 69,422.9 SOL and 6,497,738 USDC – a combined total value of just over US$8.78 million.

Following what Crema Finance described as a “long negotiation”, the hacker agreed to return most funds but retained 45,455 SOL, currently valued at approximately US$1.7 million. The hacker was also referred to as “white-hat” and “ethical” in tweets by Crema Finance, suggesting the DeFi platform won’t be pursuing criminal charges.

Following the hack, the total value locked on Crema Finance fell dramatically, dropping as low as US$3 million on July 4, having sat at over US$12 million on the Saturday prior to the hack.

Crema Finance shared the transaction details proving the hacker had indeed returned 6,064 ETH and 23,967 SOL to its accounts:

Smart Contract Suspended Pending Audit

Since the hack, Crema Finance’s smart contract has been suspended while its new smart contract code is being audited by blockchain security firm SlowMist. Crema Finance says the protocol will go live again once that audit is complete and its security can be assured:

It’s becoming increasingly common for hackers in the crypto space to agree to return most of the stolen assets in return for a bounty. In June, a high-profile case saw the the Ethereum rollup-solution Optimism hacked to the tune of US$17 million, with the hacker agreeing to return US$15 million worth of the stolen assets in return for a US$2 million bug bounty.