Partnered With:

PeckShield: A total of 29 security incidents occurred in October, and virtual currency investment fraud incidents occurred frequently

Read this article in 27 Minutes

In the past month, a total of 29 more prominent security incidents occurred in the entire blockchain ecosystem, and the degree of harm was rated as "advanced".

Original source: PeckShield

According to the data of the PeckShield situational awareness platform, in the past month, there have been 29 more prominent security incidents in the entire blockchain ecosystem , the degree of harm was rated as "advanced", involving 4 cases of DeFi, 3 cases of wallet security, 2 cases of exchanges, 5 cases of extortion, and 15 cases of fraud.

DeFi Security

A total of 4 DeFi-related security incidents occurred in October, as follows:

1) On October 11, the WLEO contract of the Ethereum project was hacked, resulting in 42,000 Funds in U.S. dollars were stolen. Hackers stole ether from decentralized exchange Uniswap’s pool by minting WLEO to themselves and exchanging it for ether.

2) On October 26, some users discovered that the DeFi mining project Harvest.finance was using the flash loan function to achieve huge arbitrage. Harvest’s official tweet explained that this arbitrage attack originated from a huge flash loan, and manipulated the price of Curve y Pool many times to arbitrage the price difference between fUSDT and fUSDC to make a profit.

3) Alex Manuskin, a researcher of the encrypted wallet ZenGo, revealed that UniCats, a so-called "yield farming platform" based on the Ethereum network, allegedly stole governance tokens including Uniswap from several users. Crypto assets worth at least $200,000, including UNI. A backdoor in the smart contract allows UniCats to retain control over user tokens even after they have been withdrawn from the user pool. A similar vulnerability was used in previous attacks against Bancor.

4) yearn.finance (YFI) disclosed a new flash loan security vulnerability, which was reported by security researcher Wen-Ding Li through Yearn's security vulnerability disclosure process on October 29 , the team removed the bug after 1.5 hours. According to the disclosure, the flash loan attack may pose a security risk to the TUSD vault funds. At present, the problem has been fixed, and the TUSD vault has been stopped from deploying funds.

PeckShield Comments: As the functions of DeFi projects become more and more diverse, hidden security issues are gradually exposed. In view of its close connection with user assets, The security issues of DeFi projects are very serious. Since each project is developed by different teams, and they have limited understanding of the design and implementation of their respective products, the integrated products are likely to have security problems in the process of interacting with third-party platforms, and then suffer from enemies. PeckShield hereby suggests that before the DeFi project goes online, it should try its best to find a team with in-depth research on the product design of each link of DeFi to do a complete security audit to avoid potential security risks.

Digital wallet security

There were 3 wallet security incidents in October:

1) Hardware wallet maker Ledger has suffered a phishing attack. Some users received emails with phishing software, resulting in the loss of funds. The hack may be related to the company's user data breach in July 2020.

2) A ZDNet investigation revealed that hackers stole $22 million from users of bitcoin wallet Electrum by luring them into installing fake software updates. And this method appeared at the highest in 2018. Since the attack was first discovered two years ago, the Electrum team has taken several steps to prevent it. But this attack still works for users with older versions of the app.

3) Recently, AlonGal, the chief technology officer of the cybercrime intelligence company HudsonRock, tweeted that on October 27, the EtherCrash cold wallet, which claimed to be "the most mature and largest gambling game on Ethereum", was stolen, and the loss was about 2.5 million US dollars. by insiders.

PeckShield Comments:As a tool for managing private keys, digital wallets are the closest place to encrypted assets. Although a cold wallet is an offline wallet that is disconnected from the network, there are also risks of physical attack and theft. For hot wallets such as web wallets, users should also beware of attacks such as phishing and malicious code injection.

Trading platform related

There were 2 trading platform-related security incidents in October:

1) On October 16, OKEx issued the "Announcement on the Suspension of Withdrawals", stating that some of the company's private key managers are currently cooperating with the public security agency in the investigation, and are currently in a state of being out of contact and cannot complete the authorization. Two sources close to OKEx said that it was OKEx founder Xu Mingxing who "cooperated with the investigation by the public security organs" in the announcement. One of the people also said that Xu Mingxing had been taken away by the police at least a week ago and had not appeared in the work group for many days.

2) imToken wallet users reported that 310,000 DAI was outflowed from the account related to the DeFi Saver Exchange vulnerability. As early as June 20 this year, DeFiSaver Twitter reported that the vulnerability in the Exchange was discovered. To protect user funds, we performed a white hack to transfer the affected funds (approximately $30,000) into a smart contract that only the original owner could withdraw.

PeckShield Comments: After hackers steal assets, they will launder money. As part of the cashout channel. This undoubtedly raises the requirements for the KYC and KYT businesses of major digital asset trading platforms. Exchanges should strengthen the review of AML anti-money laundering and capital compliance. Details can be found at www.coinholmes.com.

Extortion related

There were 5 blackmail-related security incidents in October:

1) Enel Group, an Italian multinational energy giant, recently suffered a ransomware attack, and its computer network was infected with Windows ransomware called NetWalker. It is reported that NetWalker hackers released screenshots of about 5 TB of stolen data and threatened to release the first batch of data within a week, forcing Enel Group to pay 1,234 bitcoins (about $16.8 million).

2) On October 28, the confidential medical records of tens of thousands of patients receiving psychological treatment in Finland were hacked, some of which were leaked online. Finnish police have revealed that hackers accessed the records of private company Vastaamo, which operates 25 treatment centers across Finland. Thousands of people have reportedly lodged complaints with the police. Many patients reported receiving emails demanding a payment of 200 euros in bitcoin to prevent what they discussed with their therapist from being made public.

3) News on October 14, recently, Ju, the country's first bitcoin ransomware virus developer, was successfully captured by the police in Nantong, Jiangsu. The local police in Nantong City, Jiangsu Province reported that the criminal suspect Ju, as the creator of multiple bitcoin ransomware viruses, has successfully committed more than 100 crimes, and illegally obtained bitcoin equivalent to more than 5 million yuan.

4) Recently, a ransomware attack hit healthcare software company eResearchTechnology (ERT), which provides tools for global pharmaceutical companies to conduct clinical trials, including COVID-19 vaccine trials, resulting in Potential impact on multiple new crown research projects conducted by companies including Bristol-Myers Squibb, AstraZeneca, Pfizer and Johnson & Johnson.

5) Leaders of the Group of Seven (G7) nations on Tuesday warned of a global surge in ransomware attacks, saying the hacking technique poses a threat to critical infrastructure in the world's major economies. Ransomware infiltrates and encrypts computer networks, then demands a ransom from victims to unlock their files. “The fact that criminals routinely demand ransom payments in virtual assets is of particular concern,” the G7 statement warned. The EU leader said “virtual assets” are a way for hackers to launder money. The statement called on more countries to implement the Financial Action Task Force (FATF) virtual asset protection measures.

PeckShield Comments: Ransomware security incidents have always been a major hidden danger affecting the entire Internet ecology, not limited to blocks chain ecology. Moreover, after the cryptocurrencies in the blockchain field are gradually popularized, criminals often use the better anonymity of cryptocurrencies such as Bitcoin to carry out extortion and fraud.

Other fraud events

In addition to the above, there were also many fraudulent escapes in October that deserve our vigilance , for example:

1) A Kusunose user posted on a Google forum that he lost $15,000 to a crypto scam he found in Google Ads. The dubious website, Coindaq.io, is said to be trying to take advantage of the digital yuan that China is working on, claiming that users can deposit funds on the platform to participate in digital yuan sales. Victims said they hoped Google would look into the matter and set up a page dedicated to the alleged scam.

2) The Guangzhou Public Security Bureau issued an official document stating that on October 3, Ms. Pan, a citizen, reported to the Yunpu Police Station, saying that she had met a "netizen" in September, and was later accused by the other party of In the name of investing in digital currency, he induced the download of a fake APP, and invested a total of 2.32 million yuan, and it is currently impossible to withdraw cash. The Huangpu Public Security urgently reminds us to treat digital currency rationally, and report to the police as soon as possible if we have any doubts or find that we have been cheated.

3) Recently, Lin, a resident of Furong District in Changsha, reported to the police that he was defrauded of investing in digital currency of more than 3.2 million yuan. It is reported that Lin downloaded an app called "AOC" through a website link sent by a "teacher" in a WeChat group, and registered an account. Lin transferred a total of more than 3.2739 million yuan to 13 different bank accounts provided by the other party 25 times successively. A few days later, the App showed that the digital currency he purchased plummeted by 80%. When Lin called the police, the app could no longer be logged in, and the WeChat account of "teacher" had also been blocked and lost contact. The case is currently under investigation.

4) Recently, a user suffered a phishing attack when visiting the Curve exchange website, and lost 20 bitcoins. It is reported that fraudulent gangs use the Google advertising system to purchase Google search ads, pretending to be the Curve exchange for fraudulent advertising. Due to Google's new advertising program, ads are usually displayed in the first place in the search, which has caused many users to be deceived. Dimensionality Reduction Security Lab recommends that users remain vigilant, carefully identify sources of information, and carefully identify domain names to avoid asset losses.

5) On October 12, Marius, the developer of the Ethereum client Geth, tweeted that email phishing appeared in the Ethereum development community, specifically a program called get -eth.com's website, which shows that the latest Ethereum Geth client can be downloaded. The download URL of the geth client is geth.ethereum.org, or it can be downloaded directly from github.

6) CoinGecko, an encrypted currency data company, announced through Twitter that it encountered a DDOS attack and temporarily strengthened security measures. Currently, CoinGecko is closely monitoring the development of the situation. Officials are working hard to fix it and hope to get it back up and running quickly.

7) The Xuzhou Municipal Public Security Bureau has successfully detected a "CDBC digital currency" large-scale national asset unfreezing fraud case, arrested 16 suspects, and seized more than 60 computers, mobile phones, and bank cards In this case, more than 1.5 million yuan of funds involved in the case were frozen, making the record of the largest number of arrests in one-time investigation and handling of such cases in the province. It is reported that the gang claimed that "CDBC digital currency" is the first batch of digital currency issued by the central bank, with 100 yuan per order, and each person is limited to 7 orders, which will be doubled by 100 times and 1000 times in the future; at present, all 16 suspects have been transferred to the prosecution The agency prosecuted.

8) A few days ago, the police in Huanghua, Hebei successfully smashed a trans-provincial telecommunications fraud gang and arrested 3 suspects, involving more than 1.2 million yuan. It is reported that the criminal gang used an investment app to carry out fraud by buying and selling electronic pets with virtual currency

9) The P2P bitcoin market Paxful has successfully resisted a series of serious threats, including 220,000 bot attacks and various social engineering tactics. Paxful said the attackers attempted to use automated bots to brute-force break into the accounts of users of the project. According to Paxful, about a quarter of the world's web traffic is reported to be generated by bots, which are actually programs that simulate the actions of real devices.

10) Russian state cyber hackers used bitcoin to conceal their connection to critical hacking "infrastructure," such as servers and domain names, according to an indictment released Monday by U.S. prosecutors. The lawsuit names six members of Russia's state hacking team, which allegedly carried out attacks on companies, the military, the government and thousands of victims of the 2018 Winter Olympics through Russia's military unit 7445. Prosecutors also allege they were responsible for the disastrous "NotPetya" malware attack in 2017 that caused billions of dollars in damages.

11) A few days ago, the Pudong police successfully smashed a den of virtual currency investment fraud and arrested 22 suspects. The amount involved in the case was 7.9 million yuan. It is reported that the "HASTE" virtual currency trading platform involved in the case was developed and maintained by technical personnel of a technology company founded by the criminal suspect Wu, and sold the use rights to overseas personnel. The platform can directly change the amount of virtual currency of users on the platform at will, and simulate and control the exchange rate trend of virtual currency through the operation of "robots".

12) Some third parties that have nothing to do with AAX or are not authorized by AAX have recently appeared in the market trying to fake AAX customer service through email, WeChat and Telegram, and spread online pretending to be AAX of false associations attempting to defraud.

13) According to sources in the Spanish National Police, Arbistar 2.0 CEO Santiago Fuentes was finally captured and detained by the Tenerife regional police in southern Spain on October 22. Fuentes is accused of defrauding nearly 32,000 investors in a bitcoin Ponzi scheme worth nearly 850 million euros (about $1 billion).

14) Russian state cyber hackers used bitcoin to conceal their connection to critical hacking "infrastructure" such as servers and domain names, according to an indictment released Monday by U.S. prosecutors. The lawsuit names six members of Russia's state hacking team, who allegedly carried out attacks through Russia's military unit 7445 against companies, the military, political movements, governments and thousands of victims of the 2018 Winter Olympics.

15) Yearn.Finance ran a doppelganger scam to trick visitors into sharing the private keys of their cryptocurrency wallets. Scam sites can replicate nearly every aspect of the original yearn.finance website, including its design, website copy, and even the domain name.

PeckShield Comments: Various security risks caused by lack of security awareness of users and standardized operation have been emerging in endlessly, phishing Attacks, fraud, and other incidents are typical. We would like to remind you that users should carefully keep all kinds of private information, and any small negligence may cause irreparable losses.