Partnered With:

After a nearly $8 million attack on AnySwap, hackers were able to derive a private key

Read this article in 6 Minutes

AnySwap officially tweeted that AnySwap multi-link was attacked by the V3 version, and the V3 cross-chain capital pool was affected, with a loss of about 2.4 million USDC and 5.51 million MIM.

原文标题：《知道创宇区块链安全实验室｜竟然可以推导出私钥？Anyswap 跨链桥被⿊分析》

原文来源：知道创宇区块链安全实验室

Background of the event

At 1am on July 12, 2021 Beijing time, AnySwap officially tweeted that AnySwap multi-link was attacked by the V3 version, and the V3 cross-chain capital pool was affected, with a loss of about 2.4 million USDC and 5.51 million MIM. AnySwap V1 and V2 versions are not affected by this attack, and cross-chain Bridges are not affected. I know that Chuangyu Blockchain Security Lab tracked this event and analyzed it in the first time:

Event tracking

Time of attack:

July 10, 2021 at 8:00 p.m. UTC

Attacker Address:

0x0aE1554860E51844B61AE20823eF1268C3949f7C

Attack transaction information:

A. Attack Transaction 1 -- >; Stolen amount: 1536821769 4 USDChttps: / / etherscan. IO/tx / 0 xc80e7cfeb16143cba4d5fb3b192b7dbe70e9bcd5ca0348facd20bf2d05693070

B. Attack Trading 2 -- >; 748312634922017566 277 USDC

https://bscscan.com/tx/0xa8a75905573cce1c6781a59a5d8bc7a8bfb6c8539ca298cbf507a292091ad4b5

C. Attack Transaction 3 -- > 112640877 101 USDChttps://ftmscan.com/tx/0x7312936a28b143d797b4860cf1d36ad2cc951fdbe0f04ddfeddae7499d8368f8

D. Attack Transaction 4 -- >; 5509227353 72 MIMhttps: / / etherscan. IO/tx / 0 xecaaf8b57b6587412242fdc040bd6cc084077a07f4def24b4adae6fbe8254ae3

Technical analysis

There are two V3 Router transactions under the MPC account of the V3 router on the BSC, and these two transactions have the same R-value signature. The attacker can reverse push out the private key of the MPC account, and it is known that this attack method has been verified by the local test of the Creator Security Team. If the same R value (ECDSA signature algorithm) is known in the two transactions, the random number seed used in the signature can be reversed due to the difference in the original data of the two signatures, and since the public key can be deduced from the address, the private key of MPC address can be reversed through the script (as shown in the screenshot below). Finally, the attacker calls anySwapInAuto function as MPC to complete the theft. Key parts of the code:

The result of code execution is as follows:

Subsequent progress

The AnySwp project will compensate for the loss caused by this theft event, and update the master contract code in the next 48 hours to repair the private key leakage event caused by using the same R signature. If there is any new progress, the laboratory will follow up and analyze it in the first time.