Partnered With:

PeckShield: 11 security incidents in February, resulting in losses of more than $300 million

Read this article in 14 Minutes

Among the 11 security incidents, there were 4 DeFi, 4 trading platforms, 1 DApp, 1 personal theft and 1 wallet.

PeckShield: 11 security incidents, $48.23 million loss in February
Source: PeckShield

According to data from PeckShield's situational awareness platform, in the past month, there were 11 outstanding security incidents in the whole block chain ecosystem, with a harm rating of "medium". The damage amounted to $48.23 million, involving 4 defis, 4 trading platforms, 1 DApp, 1 personal theft, 1 wallet, etc.

DeFi security

There were 4 DeFi security incidents in February, as follows:

1) on February 15, the bZx team of DeFi project issued an announcement on the official cable group, saying that hackers had made a vulnerability attack on the bZx protocol. PeckShield security personnel took the initiative to follow up on the bZx attack and found that it was an attack on the design of sharing composable liquidity between DeFi projects, especially DeFi projects with leveraged trading and lending capabilities, which could be more easily exploited. (for details, see PeckShield: hard technology analysis, bZx protocol vulnerability attack)

2) on February 18th, bZx suffered a similar attack again. This attack is different from the last one in terms of technical principle. The hacker "cheated" bZx contract by manipulating Oracle price. (see PeckShield: the technology behind another bZx attack)

On February 23, Chainlink caused a loss of about $40,000 by incorrectly marking the price of gold (XAU) as silver (XAG) due to a human error during a feature upgrade.

4) on February 29, Curve, a decentralized stable currency trading platform, experienced an abnormal transaction in which USDC worth 89,000 us dollars was exchanged for BUSD worth 465,000 us dollars. The attacker made a pincer attack on the busd. Curve. Fi and y. Curve. Fi capital pools of Curve.

PeckShield comments: as the DeFi project becomes more and more functional, the security issues hidden in the DeFi project are gradually exposed. Given its close relationship with users' assets, the security issues of DeFi project are very serious. As each project is developed by a different team with limited understanding of the design and implementation of their respective products, integrated products are likely to suffer from security problems in the process of interacting with third-party platforms. PeckShield recommends that the DeFi project team conduct a full security audit with a team that has done in-depth research on DeFi's product design before going live to avoid potential security issues.

Trading platform security

In February, there were four security incidents on trading platforms, including two hacking incidents:

1) on February 10, the server storing the private key of hot wallet on Altsbit trading platform was invaded, and the private key of hot wallet was stolen, resulting in the loss of users' assets.

2) on February 17, VBITEX trading platform issued a notice saying that it had been hacked, resulting in malicious manipulation of platform data and theft of virtual assets.

3) on February 17, FCoin trading platform claimed that due to financial difficulties, its capital reserve could not be redeemed for users to withdraw money, and the estimated amount of unredeemed funds is between 7,000-13,000 BTC.

4) on February 28, trading platforms such as OKEx and Bitfinex suffered frequent DDoS attacks, affecting relevant services.

CoinHolmes, a visual digital asset tracking system owned by PeckShield security team, conducted targeted tracking and analysis of related addresses in response to the financial difficulties of FCoin trading platform. The tracking system on the CoinHolmes chain includes dozens of trading platforms, more than 60 million address labels, involving BTC, ETH, USDT and other mainstream digital assets.

Use CoinHolmes figure 1 to overview the asset flow of FCoin, as shown in the following figure:

PeckShield: 2 月共发生安全事件 11 起，损失 4,823 万美元

Combined with data analysis and visual graphics, PeckShield security officials speculated that FCoin's funding chain may have been compromised as early as July 2018. (for details, see PeckShield: FCoin's asset flows are showing weakness at their peak?)

PeckShield comment: through FCoin, people begin to realize the potential crisis of centralized trading platform due to the lack of transparency of assets. This is a disaster, but it is also hoped to be an inflection point, as more centralised trading platforms recognise the importance of transparency and reserve compensation. PeckShield recommends that trading platforms use a more secure system to protect their private keys and promptly patch operating system or third-party software vulnerabilities if their private keys are stolen or their servers are compromised.

DApp ecological

A total of 1 DApp security incident occurred in February, which existed in the TRON network. Specifically, on 03 February, hackers at the TKnzni address continued to roll back trades at the LuckLambo104 contract address at the beginning of TGsyJF by creating attack contracts, making a profit of 6,588 TRX.

PeckShield review: most DApp eco-security incidents are caused by contract players, and DApp should check if the target account is a smart contract before accepting a player's token or rebate. At the same time, developers should do security testing before the contract goes online to defend against known attacks. If necessary, they can seek the assistance of third-party security companies to help them complete the pre-contract attack testing and basic security defense deployment.

SIM card attack

In February, a BTC topwhale account was stolen. On February 22, a user calling himself "zhoujianfu" posted on Reddit that he had lost 1,547 BTCS and 60,000 BCH, worth about 260 million RMB, in a hacker attack, the biggest personal theft in recent years.

Based on the address provided by the victim, PeckShield security team's visual digital asset tracking system, CoinHolmes, quickly located the hacker's address, conducted targeted tracking and profiling, and finally created a visual path transfer panorama:

PeckShield: 2 月共发生安全事件 11 起，损失 4,823 万美元

As shown in the figure, the hacker transferred the funds on the chain in a very professional and complicated way, so that there was no clear hierarchy and context after the visualization tool was made. By following up on the analysis of the BTC assets stolen from orca's account, the PeckShield security staff discovered that the hackers, after stealing 1,547 BTCS, quickly split up the funds, breaking them up in small amounts, and further attempting to make asset tracking extremely difficult through a more sophisticated obfuscating system.

Since the incident on February 22, hackers have used hundreds of addresses to transfer funds in just a few days, with the deepest level reaching 20. In the process of capital splitting and transferring, 11.19 BTC has been transferred to the address of the Bittrex trading platform through multiple transactions. So far, most of the stolen funds have remained at the hackers' addresses, and PeckShield is monitoring further movements of targeted funds. (for details, see PeckShield: uncovering the whale account theft by a highly skilled group of hackers)

PeckShield comments: there is reason to believe that the hackers involved in this attack are a professional and highly skilled group. The gang from the selection of targets, to the chain + chain long time tracking and breakthrough, put a lot of effort. This seems to be a reminder to some of the early and lucrative owners of cryptographic assets to guard their cryptographic assets against SIM card attacks, phishing and other common forms of theft.

other

In addition to these, there were other security incidents in February that were also alarming:

1) hackers used the flaw in IOTA's official wallet app Trinity to steal funds, and the authorities later announced the shutdown of the entire network.

2) beware of malware called Raccoon, which USES phishing and toolkits to steal users' data and cryptocurrency through the browser.

PeckShield comments: there have been numerous security threats caused by users' lack of security awareness and standard practices, such as phishing attacks and fraud. In this reminder, users should be careful to keep all kinds of private information, any small negligence may cause irreversible losses.

Source:weixin.qq.com