Partnered With:

Peckshield: Who is responsible to the investors when the project goes missing?

Read this article in 17 Minutes

In the past month, there were 38 more prominent security incidents in blockchain ecological symbiosis.

Peckshield: Who is responsible to investors when projects go awry?

Original source: Peckshield

According to data from the Peckshield situational awareness platform, there have been 38 prominent security incidents across the blockchain ecosystem in the past month. There were 21 cases involving DEFI, 6 cases involving exchange security, 1 case involving extortion, and 10 cases of fraud.

CEX public chain DeFi "earth mine" run Who is responsible to investors?

After DEFI ignited FOMO sentiment in 2020, CEX (centralized exchange), which used to be the top of the food chain, gradually lost its advantage, especially after it changed from an incremental market to an inventory market, and CEX began to seek new breakthrough points. As the cornerstone of the blockchain industry, the public chain is an important breakthrough point for the exchange to make efforts. It can not only connect the various ecological layouts of the exchange together, but also connect with DEFI.

In the second half of 2020, Binan, Huobi, OKEx and other major centralized exchanges have accelerated the layout of their own public chain support DEFI project, in order to seize a share of DEFI market.

Since 2021, the DEFI project on the CEX public chain has been running away. According to Peckshield, there were at least four DeFi "earth mine" projects on the CEX public chain in February.

On February 1, media reported that the Defi "dirt mine" projects Popcornswap and Multi Financial on Binan's smart chain ran away, losing about 48,000 and 5,000 BNBs, respectively. Previously, the DEFI projects such as Zap Finance, Tin Finance and SharkYield on the Binance smart chain were reported to have run away one after another.

On February 8, 5.8 million HUST was suspected stolen from Filda, a lending project on the Huobi public chain HECO.

On February 28, media reported that TokenLink, a project on the Huobi public chain HECO, was suspected to have run away and lost millions of USDT.

The DEFI project on the CEX public chain has run away, to whom should investors be held accountable?

In this regard, the relevant person in charge of CEX has said that the public chain built by CEX is the same as the public chain such as Ethereum, and should not be responsible for the project that may have problems built on it.

According to security experts at Peckshield: "Launch from CEX male chain positioning point of view, they focus on building a public chain, namely the licensing chain (Permissionless Blockchain). Ideally, anyone can participate in block chain data maintenance and read, easy to deploy applications, decentralization is not controlled by any institution completely. But it is worth noting that CEX launched by the chain is still in the early stage of development, in the process of constructing ecological, may also need to have a" weak "centralized transition process. From the Angle of investors, owing to the chain of the CEX CEX deployment, Although CEX can disclaimer the project, users may regard its brand as a kind of credit endorsement. It is urgent for CEX to improve and perfect the institutional governance."

The DEFI composability vulnerability continues to be highlighted

In addition to the DeFi project security incident on the CEX public chain, according to Peckshield statistics, a total of 21 DeFi security incidents occurred in February, the fraud has spread to the DeFi field, DeFi's combability vulnerability continues to highlight.

On February 5, the Yearn V1 Ydai Vault was attacked. The Vault lost $11 million and the attackers stole $2.8 million.

On Feb. 5, Defi's insurance program, Armorfi, paid a $1.5 million bounty to white hat hackers for vulnerabilities. The hacker is understood to have discovered a "critical vulnerability" in the protocol that could have wiped out all of the company's underwriting funds.

On Feb. 8, decentralized trading protocol Curve said it had found problems with Yearn's brand new YV2 pool, which has been shut down to protect liquidity providers.

DyDX, a decentralized derivatives exchange, said on its official Twitter account on February 9 that it has not yet launched a coin, nor has it conducted pre-sales or airdrops. Users should be alert to related scams.

On Feb. 9, smart Defi revenue aggregator Bt. Finance was hacked, losing about $1.5 million.

On Feb. 13, Defi Cream.Finance and Alpha Finance were hit by Flash Loan attacks, resulting in losses of $37.5 million.

On February 15, Primitive Finance, an option protocol on the Ethereum chain, tweeted that Primitive Finance does not have an agreed token and users should be aware of scams.

On February 20, the Tezos-based build Dex Dexter was exposed to a contract bug that allowed unauthorized withdrawals of funds, and the development team Nomadic Labs has rewritten the contract.

On Feb. 21, DAO Maker tweeted to warn users of scams impersonating DAO Maker.

On February 22, a serious flaw was discovered in the Primitive Finance smart contract, an options protocol on the Ethereum chain. Since contracts cannot be upgraded or suspended, officials use their smart contracts to hack to protect user funds.

On February 22, ForTube, a decentralized lending protocol, revealed a security breach that occurred two weeks ago, and no users have yet lost money as a result of the breach.

On February 24, Matter Labs, the developer of Ethereum's two-layer expansion solution, tweeted questions about the security of user funds on decentralized exchange ZkSwap.

On February 25, a report pointed to a possible security breach in the approval mechanism used by automated market makers before trading or token swaps, which it said allows third parties to send tokens from users' accounts on their behalf. At the same time, the report found that fraudsters were using the technique to trick Link into phishing emails.

On February 26, Defibox monitoring found that the online fire currency ecological chain HECO fund investment platform MFD pre-digging risk.

On February 27, DAI pool of DEFI income aggregator Yeld.Finance was hit by lightning loan attack, resulting in loss of 160,000 DAI.

On February 28th,Defi aggregation platform Furucombo was hacked, losses of more than $14 million. Cream Finance was affected by the breach and lost about $1.1 million because it did not withdraw all authorization of external contracts from its wallet ina timely manner.

On February 28, Defi insurance agreement Armor.fi tweeted that 1.2 million Armor tokens had been defrauded by a fraudster from team members and had been sold off for around 600 ETH ($850,000).

Peckshield found that the Defi project Furucombo and Primitive Finance attacks in February were linked to Defi's unlimited license model, which allows wallets to control all assets without any permission from the user and is not restricted by the user's private key custody. PeckShield warns users not to over-authorize.

For protocol developers, on the basis of trying to innovate, they need to improve their security awareness, locate the possible problems of the combination, and fully consider the business logic defects in the system combination when doing security audit, so as to give priority to security defense. Secondly, because the DEFI project is closely linked to assets, it is easy to become a potential target of attack, which requires the DEFI protocol developer to upgrade the level of security defense, including security audit before the project goes live, abnormal data warning during the project operation, and timely emergency response in case of crisis, etc.

Exchange attack

According to Peckshield, there were six typical exchange security incidents in February, including a DDoS attack on the UK cryptocurrency exchange Exmo that halted server use.

In a major security incident, exchange Cryptopia was hacked again on February 1, stealing around NZ $62,000 ($45,000) of cryptocurrency. Investigations revealed that the hackers gained access to a wallet that had been dormant since it was stolen in 2019 and controlled by Cryptopia liquidator Grant Thornton.

Fraud & amp; blackmail

According to Peckshield's anti-fraud situational awareness system, CoinHolmes, there were 10 fraud-related security incidents and one extortion incident in February.

On February 4, a Bitcoin giveaway scam appeared on the social platform Discord to collect encrypted user data.

On February 5, an Australian man pleaded guilty to an alleged $90 million fraud through a cryptocurrency hedge fund.

On Feb. 5, German prosecutors seized more than 50 million euros ($60 million) worth of bitcoin from a fraudster, but were faced with the awkward problem of being unable to crack the key to unlock the asset.

On February 6, the U.S. Department of Justice (DOJ) announced that Antonije Stojilkovic, a Serbian citizen suspected of defrauding cryptocurrency investors of more than $70 million, has been extradited to the United States to face charges of conspiracy to commit fraud and money laundering. Stojilkovic and his associates allegedly set up more than 20 fake trading platforms in Serbia and elsewhere.

On February 8, Stephen Dediore, a Florida telecom company, was charged with SIM exchange fraud and stealing cryptocurrency. If convicted, Dediore faces up to five years in prison and a fine of up to $250,000.

On February 10th the Twitter account of Tinne Van der Straeten, Belgium's energy minister, was hacked. Its Twitter account was renamed the "Ethereum Foundation" and posted about the Ethereum giveaway scam to lure its followers to the fraudulent site.

On February 11, European Union law enforcement agencies arrested hackers who stole $100 million worth of cryptocurrency through SIM exchanges.

On Feb. 11, Japanese prosecutors have charged a group with handling $180 million worth of stolen virtual currency from the Coincheck exchange.

On February 17th the US government indicted a group of North Korean hackers Lazarus Group , allegedly stole more than $1.3 billion in funds and virtual currency.

On February 18, Kia Motors, a carmaker, was hit by a ransomware attack in which hackers demanded 600 Bitcoins (worth a total of $30m) as ransom.

Due to the anonymity of cryptocurrency, the complex transfer path of on-chain assets and the difficulty of technical tracking, the difficulty of relevant department's inspection and enforcement has been increased. In addition to improving relevant laws and regulations, global law enforcement agencies urgently need to introduce new regulatory tools and technologies.