Partnered With:

PeckShield: There were 33 security incidents in September, and DeFi fraud runaways were frequent

Read this article in 27 Minutes

In the past month, there were 33 prominent security incidents in the whole blockchain ecology, with the hazard rating of "advanced", involving DeFi 15, wallet security 1, public chain security 1, exchange related 3, extortion related 7, fraud incident 6,

Original title: PeckShield: 33 Security Incidents, DeFi Fraud Run-ins frequent in September

原文来源： PeckShield

According to PeckShield Situational Awareness platform data, in the past month, there were 33 prominent security incidents across the blockchain ecosystem, with an "advanced" hazard rating, involving DeFi 15, wallet security 1, public chain security 1, exchanges related 3, extortion related 7, and fraud related 6.

A total of 15 DeFi related security incidents occurred in September, as follows:

1) The developer found a double-flower governance vulnerability in SushiSwap, which can multiply the governance capability of a person without the need to obtain new tokens. Sam Bankman-fried, CHIEF executive of FTX and head of SushiSwap, confirmed the vulnerability. This does not pose an immediate problem for Sushi, he says, because governance has not yet started.

2) DeFi Stable Currency Agreement Lien released a statement saying that the team's auditors discovered a vulnerability in the Lien App and decided to temporarily maintain the platform to prevent the vulnerability from being exploited, indicating that users' ethereum assets stored in the agreement were safe and that there was no theft of funds.

3) On September 19, the team of Bantiample, a project on the Currency an smart chain, sold 3000 listings. Currently, the main developer of the team has deleted the Telegram account and the project token BMAP fell by more than 90% in a day.

4) Ethereum mining project LV Finance project is suspected to be on the run. This project deceives investors to invest by forging false audit websites and providing false audit information. After a period of time, the project will run away when the amount in the capital pool is large enough. The project's website, Lv.Finance, is no longer accessible.

5) Mr. Waste (weibo user name "Waste X waste") participated in the liquid mining project Soda and found a loophole in which 20,000 ETH could be directly liquidated. But he chose to tell the development team, but they didn't pay attention. He chose to liquidate an ETH and tweeted a warning to developers that the Bug existed. Less than an hour later, the project team issued an announcement: stop the function of borrowing money in the front end. If anyone loses money due to this bug, we will try our best to launch the compensation scheme in the future.

6) SushiSwap copy disk project named GemSwap was exposed to run away, and LP was swept away. Query, the project released in 15 o 'clock today twitter revealing its attack suffered "whatitdobb" developers, it is understood that the project was completed earlier today liquidity migration, but the attack developers won the relevant license before migration, able to flow in the pool tokens, take, it is unclear how much damage caused by the attack.

7) bZx official Twitter said that its contract had been attacked and 4700 ETH had been lost. In the following two days, the attacker returned all stolen assets to the project party.

8) At least nine Chainlink node operators were attacked last Sunday, depleting about 700 ETH in their wallets. The attack allegedly exploited the way the nodes responded to queries and involved the use of tokens related to the cost of network transactions. Chainlink has confirmed the attack and describes it as a "failed attempt" to "spam" a network.

9) Ethereum developer Philippe Castonguay tweeted that both the DeFi project BaconSwap and Shroom.Finance have time-locking loopholes that will allow project owners to issue unlimited tokens without having time to lock them.

10) Amplify, a Twitter user, revealed that he made $250,000 from a bug in the new DeFi project Soft Finance. He said he was not the perpetrator but had stumbled across the "opportunity". Gone is the clone of Soft Finance, which launched SYFI, a soft-anchor adaptive system token, using a rebase mechanism to match supply with demand. On The 4th of this month, a system failure in the rebase process caused the price to be reset to zero.

11) Wave Field DeFi Project Cherry CherryFi says in the telegraph group that the USDT contract cannot be extracted due to a single line of code during the migration. Users who lose USDT can contact the administrator. The team will offer a compensation plan and advise users to withdraw TRX. It is understood that the CherryFi code is unaudited.

12) A user stated in the community that 100,000 USDT was stolen while participating in Diamond. Finance, a mobile mining project based on EOS. PeckShield security personnel followed up and analyzed that the reason for the user's theft had nothing to do with eosio.code permission, and it was suspected that the private key had been stolen.

13) EOS project EMDS are suspected to be running away. So far, Project Contract EmeraldMine1 has transferred 780,000 USDT, 490,000 EOS and 56,000 DFS to attacker account SJI111111111, and 121,000 EOS have been transferred to Changenow coin washing platform.

14) The wRAM of corals in EOS mining project was "re-entered" by hackers, resulting in a loss of over 120,000 EOS. The attacker's account USES a similar "reentry attack" mode to attack the EOSwramToken contract. Specifically, the attacker embedded an inline transfer in the normal transfer operation, making the wRAM contract judge the amount of RAM in MINT when there was a problem, leading to more.

15) yearn. Andre, founder of the finance Cronje, launched the game project Eminence (ENM) encounter "Flash" attack, hackers will return $8 million of funds to the yearn deployer contracts. Officials are investigating the situation and will redistribute the $8 million hit.

PeckShield review: As the DeFi project becomes more and more versatile, hidden security issues are becoming more and more apparent. Given its close relationship to user assets, security issues for the DeFi project are very serious. As each project is developed by different teams with limited understanding of the design and implementation of each product, the integrated product is likely to have security problems in the process of interacting with the third-party platform, and thus suffer from both sides. PeckShield recommends that the DeFi project side conduct a full security audit with a team that has done in-depth research on all aspects of DeFi's product design before going online, as far as possible, to avoid potential security risks.

Digital Wallet Security

A total of 1 wallet security incident occurred in September:

1) ShiftCrypto, the Swiss company that developed the BitBox hardware wallet, revealed that a vulnerability was found in the Trezor and KeepKey hardware wallets that allowed attackers to hold the user's cryptocurrency for blackmail without going near the device.

PeckShield review: A digital wallet is the closest thing to an encrypted asset as a tool for managing private keys. While a cold wallet is an offline wallet that is disconnected from the Internet, it is also at risk of physical attack and theft, while a hot wallet like a web wallet also requires users to be wary of phishing attacks, malicious code injection, and other attacks.

Public security chain

A total of 1 public chain-related safety incident occurred in September:

1) Bitcoin engineers Braydon Fuller and Javed Khan fixed a bug called INVDoS on the Bitcoin blockchain in 2018, and this week published a research paper detailing how they found Btcd and Decred in multiple other blockchain iterations. The attack works this way: one hostile blockchain node (a member of the blockchain network that verifies transactions) floods another by spamming a non-existent transaction. The vulnerability, known as a denial of service attack, could be "easily exploited" by hackers and could be used to crash an entire network of Bitcoin nodes. This could lead to delays in processing transactions, which in turn could lead to "a loss of capital or revenue", the report said.

PeckShield review: Once the vulnerability on the public chain is found, it will have a great impact on the whole chain ecology. Therefore, the public chain must do security testing and vulnerability detection before the official release, and seek third-party security company audit, so as to avoid the vulnerability threat affecting the public chain ecology.

Exchange correlation

There were a total of three exchange-related security incidents in September:

1) European cryptocurrency exchange ETERBASE has been hacked, resulting in the theft of some hot wallet assets, including BTC, ETH and ERC-20 tokens, XRP, TRX, XTZ and ALGO. The exchange is currently in maintenance mode and is investigating the issues. According to The Block Research, ETERBASE's stolen assets exceeded $5 million, with ETH and ERC-20 addresses losing The most money, at about $3.9 million, followed by XTZ addresses, at about $471,000.

2) The Kucoin Exchange was hacked and a large number of ETH and ERC20 tokens were transferred, including 11,000 Ethereum, 20 million USDT, 11 million AMPL, 8.8 million OCEAN, 7.2 million VIDT, 5 million DIA, 5 million AKRO. Since then, Uniswap has been used many times by the hackers to transfer funds, which have been blocked by various major exchanges.

3) Seoul police raided Bithumb, South Korea's largest cryptocurrency exchange, on Sept 2. Lee Jong-hoon, speaker of Bithumb's Council of South Korea, is under police investigation for fraud and escaping property. The seizure was related to investment fraud related to the issuance of BXA tokens, according to the Seoul Public Security Department. BXA victims said Ms Lee and others had made losses by pre-selling Won30bn tokens under the name of listed BXA but not actually listing.

PeckShield review: Hackers who steal assets and launder money, no matter how sophisticated, typically use the exchange as part of a cash-out channel. This undoubtedly raises the requirements for KYC and KYT businesses of all major digital asset exchanges, and the exchanges should strengthen the review of AML anti-money laundering and capital compliance. Details can be found at www.coinholmes.com.

Blackmail associated

There were 7 security incidents related to extortion in September:

1) Not long ago, a private company in Hangzhou High-tech Zone (Binjiang) reported to the public security authorities that someone had maliciously attacked its official website and blackmailed one Bitcoin.

2) K-Electric, Pakistan's largest electricity producer, has been hit by a ransomware attack this week, with hackers demanding an estimated $7.7m in bitcoin as ransom, according to the Internet security website Bleeping Computer.

3) Hackers recently broke into Argentina's immigration system, demanding a ransom of $4 million in Bitcoin from the Argentine government, which temporarily paralyzed cross-border migration. But the Argentine government refuses to negotiate with the hackers and will not pay a ransom.

4) Banco Estado, one of Chile's top three Banks, had to shut down its nationwide operations Friday because of a cyber attack on its Ransomware program. REvil has been known to auction off data stolen in attacks and often demands ransom payments using Monero (XMR).

5) Hackers carried out a ransomware attack on Tower Semiconductor Ltd (TSEM), a Nasdaq-listed maker of wireless chips and camera sensors, and demanded a ransom of hundreds of thousands of dollars in Bitcoin. For security reasons, TSEM has shut down some running servers and suspended production at some plants.

6) Tesla founder Elon Musk has confirmed in a tweet that Egor Igorevich Kriuchkov, a Russian man, bribed an employee at a Tesla factory in Nevada with $1 million in bitcoin to install ransomware on tesla's computer network. Instead of implementing the plan, the employee notified other Tesla employees who contacted the FBI. The FBI arrested the man in Los Angeles on August 22 and he faces up to five years in prison if found guilty.

7) Hospitals and companies in Thailand were attacked by hackers who hijacked computer systems and data and demanded payment in bitcoin to recover the information, Thai police said. On September 5, the Saraburi hospital was unable to access its data and the attackers demanded 63 billion baht (a $2.8 billion) in bitcoin to unlock the system.

PeckShield review: Extortion security incidents have been a major threat to the entire Internet ecosystem, not just the blockchain ecosystem. Moreover, after the popularity of cryptocurrencies in the blockchain field, criminals often take advantage of the good anonymity of cryptocurrencies such as Bitcoin to carry out extortion fraud.

Other frauds

In addition to the above, a number of fraudulent run-away incidents occurred in September, such as:

1) ESET researchers have discovered a new piece of malware that infects devices via the Tor network and the Bittorent protocol. Krypto Cibule infects a user's device to encrypt some mining and USES a 'clipboard hijacking' to transfer money to a hacker's wallet.

2) Colombian police have warned the nation that fraudsters are scams using Bitcoin and launched an initiative claiming to have the support of President Ivan Duque. According to the fraudsters, President Duke signed an "agreement of the century" to create a platform called the Age of Bitcoin, which will allow Colombians to earn income from cryptocurrencies. In response, police stressed that the bitcoin focused investment solution for the economic impact of COVID-19 was a hoax and had not been approved in any way by the President of Colombia.

3) The Public Security Bureau of Xi 'an Hi-tech Industrial Development Zone arrested the suspects related to the virtual currency fraud case on September 2. The gang had previously posted fake information about the virtual currency, BRTR, online to entice people to buy it, and had swindled more than 5 million yuan in just one month. According to the investigation clues collected in the early stage and the confession of the suspect, the police handling the case have recovered all the involved funds of more than 5 million yuan and frozen them according to law. At present, the case is still in further trial.

4) On September 21, wuhan Public Security Bureau donghu New Technology Development Zone branch successfully broke up a fraud ring. The police investigation found that the gang used the high return of the virtual currency as bait to attract investors to invest, and then carried out the fraud ring. At present, the police have mastered the situation of many people who were cheated, involving nearly 300,000 yuan. Four people involved in the case, surnamed Cao, Luo, Chen and Yuan, have been detained by dongxin police for fraud. The case is digging deeper.

5) The Beijing Daxing Public Security Bureau reported today that police have arrested four suspects in a gang that illegally took public deposits in the name of betting on "digital currency." It is reported that more than 1000 investors involved in the investment of more than 20 million yuan trapped. The four suspects profited more than 2 million yuan.

6) Recently, the Minhang police in Shanghai smashed a criminal gang that committed fraud in the name of investing virtual currency and arrested 35 suspects. The fraud gang used the phone and WeChat to find potential victims with the intention of investing virtual currency, pulled them into the group of investing WeChat, and tricked the victims to download "bitex", "back" and "bitbank" platform to make virtual currency investment, defrauding the victims of investment principal, the implementation of fraud crime. The gang involved a total of more than 10 cases, involving more than 800,000 yuan, involving more than 100 victims.