Partnered With:

A review of security incidents in the first half of 2021: Hacks, scams, and outages

Read this article in 18 Minutes

The world of cryptocurrencies has never been more treacherous, and it's hard to ignore.

原文标题：《 2021 (the first half) In Review: Crypto Hacks, Scams & Shutdowns 》

原文作者： Harry Denley

原文编译：阿剑，以太坊爱好者

The world of cryptocurrencies has never been more treacherous, and it's hard to ignore. Before listing these security incidents in detail, what do we contribute to the safety of the industry?

In the first half of 2021, we:

● 放出了新版的 MyCrypto，提高了用户体验，让用户能更容易、更直接地使用和监控自己的密码学货币

● 披露了滥用 ERC20 授权方法来偷窃用户资产的恶意项目（授权方法是用户使用的一环，但很容易被盲目信任）

● 拓展了我们的业务范围，帮助遭遇了清道夫机器人的用户取回质押的资产（中文译本）

● 出版了一份帮助用户提高 MyCrypto 隐私体验的指南

● 在 NFT 市场爆发时，我们也推出了针对 NFT 买家的反诈骗教育材料

● 与 CryptoScamDB 继续我们的反诈骗、反钓鱼活动

Raising the awareness of the entire industry and preventing fraud and attacks is a long way off, but we are persevering.

Let's take a closer look at the industry as a whole and see if we've learned lessons and improved from 2020.

The following is a list of major safety events for the first and second quarters of 2021. We're not going to list all the runaways and things like that because there are too many, too many to count...

The first quarter of 2021 had some interesting events, from the abrupt shutdown of the entire agreement to the breach of the DEFI contract to the arrest of hackers. We're also seeing attacks that are totally personal, which has shocked the industry because these bad guys could do anything for a bunch of money. There were fewer breaches of cryptocurrency exchanges in the first quarter compared to last year. This is both because hackers' attention is elsewhere and because exchanges have learned from last year's failures and adjusted their security controls.

STORY: $11 million stolen from Yearn

Abstract:One of the largest/oldest automated liquidity mining protocols, Yearn, suffered a blowup in one of its V1 vaults, with a total of $11 million stolen, while Vault users suffered direct losses of $2.8 million. The Yearn team managed to mitigate the blast in 10 minutes and 14 seconds, including Tether freezing 1.7 million USDT to prevent the attackers from transferring assets.

Story: DMM DAO shut down due to SEC investigation

Abstract:The DMM DAO, a DAO that used the ChainLink messaging mechanism to move real world assets onto the chain, was discontinued due to the SEC investigation into them.

Story: Blockfolio Hacked to Output Offensive Content

Abstract:In February, a malicious person gained access to the content-pushing system used by Blockfolio and then pushed offensive content to all users of Blockfolio. Soon after, the SBF confirmed and explained what had happened, and then they put the blame on their competitors, claiming that "malicious content was created and posted by our exchange peers".

STORY: T-Mobile sued over $450,000 worth of Bitcoins lost to customers in SIM attack

Abstract:SIM card theft is all too common in the crypto-currency world! (We even wrote a big article about it!) The victim sued her service provider after she lost 15 Bitcoins due to a stolen SIM card. (Note: SIM card "stolen" refers to that after the attacker learns the personal information of the target victim through various attack means, the thief calls "stop thief" and tells the service provider that his SIM card has been stolen or lost, thus gaining the control of the target SIM card.)

Story: Defi protocol Cream Finance Alpha suffered a flash loan attack and lost $37.5 million

Abstract:A clever flash lending attack allowed the operator to drain AlphaFinance's coffers of contracts. Frankresearcher revealed the whole story in a long tweet. Soon after, AlphaFinance hinted that it knew who the attacker was.

Story: A local vulnerability in a MetaMask instance resulted in the theft of $8 million

Abstract:This incident alerted the entire community to the dangers of blindly trusting a UI, and to accept that what you once considered credible could one day become unsafe. This post mortem report shows just how hard an attacker would go to get your money by hijacking your computer. After checking for malicious behavior, we were assured that it was "well thought out."

Story: Roll stolen 3000 ETH/ $5.7 million

Abstract:Roll, a platform for issuing social tokens, suffered an accident when the private key of a hot wallet was hijacked, and the attacker sold all the social tokens as ETH (which also drove down the market price of these social tokens) and migrated ETH to another address via Tornadocash.

STORY: Twitter hacker pleads guilty, gets three years in prison

Abstract:Last year saw a massive Twitter account hack, in which many high-value accounts were posted by Twitter's internal tools, fuelling the scam. Within a year, the hacker -- who was only 18 years old -- was arrested and sentenced.

Story: Filecoin had multiple costs on Bitcoin -- $4.6 million

Abstract:Binance processes a legitimate deposit twice and counts double the amount down the chain, according to the developer. This error is caused by a bug in the Filecoin RPC code.

Story: GitHub Actions were actively misused to mine on GitHub servers

Abstract:GitHub allows the server to run code to help test. Some people with ulterior motives use this (free) server to mine -- they have no power costs or maintenance costs at all, and they earn block bonuses.

Story: XForce is breached by White Hat (and others)

Abstract:XForce contracts are not strictly ERC20 compliant, which leaves a hole in their depositing mechanism, which is tied to XForce token minting. As long as you have XForce tokens (neither of which need to be physically deposited), you can withdraw Force tokens (which are essentially free).

Story: The verifier dropped out of the Stellar network

Abstract:Because of a bug in the software, a group of verifiers on the Stellar network suddenly went offline, causing the transaction to break. More than 10 hours later, the source of the problem was identified and fixed, and the verifiers were back online.

Story: Class action lawsuit against Legder and Shopify for leaking user data in 2020

Abstract:In 2020, a database of about 300,000 Ledger customer records (with detailed customer email addresses, receiving addresses, and full names) appeared on a forum called RaidForums and was downloaded for free. On April 6, 2021, a group of individuals filed a class action lawsuit.

Story: More addresses hit the blacklist for transferring USDC

Abstract:Although such cases are rare, Circle, the authority behind the USDC, has published more than seven blacklists. The USDCs in these addresses can therefore be confiscated, and Circle can prevent users from using these coins (see the contract's "transfer()" function). This is because the US Financial Bureau has added these addresses to the OFEC's SDN list.

The story: $2 billion scam that shut down Turkish exchange Thodex amid user protests

Abstract:A Turkish exchange abruptly ceased service. Its CEO is thought to have fled to Thailand with the exchange's private key, which controls $2 billion worth of cryptocurrency held by the exchange's users. Since then, a statement has replaced ThodX's home page, detailing that they are in talks with business partners and that an attack has altered some of Tameness's back-end data. They also claim that the media figure of $2 billion is wrong and that the actual amount is much lower.

Story: UraniumFinance's move blew up, with potential losses of $5 million

Abstract:There was a mathematical error in UraniumFinance's process of changing the transaction procedure rate, resulting inan unexpected calculation error, which affected the actual transaction procedure rate. A character in the contract causes the balance check of the health check of the smart contract to be utilized and the reserve of UraniumFinance to be sucked dry.

STORY: The U.S. Justice Department has admitted to the arrest of Roman Sterlingov, the operator of Bitcoinfog

Abstract:Bitcoinfog is a popular currency mixer that adds some ambiguity to Bitcoin transactions. Bitcoinfog is said to have earned around 1.2 million BTC over the past 10 years.

Story: Xtokenmarket liquidity pool drained, $25 million lost

Abstract:In another clever flash loan attack, the attackers drained the liquidity pool of XTokenMarket by manipulating the prices of SNX and BNT across multiple Dex. The attack was carried out using MEV software called "Flashbots".

Story: Defi 100 carries $32 million on the run

Abstract:A Defi protocol taunts users with public messages and says it will run: "We lied to you! There's nothing you can do!" The next day, they released a statement saying they had not run away and had restored the site to its previous state.

Story: Entity fishing campaign for Ledger

Abstract:After a data breach in 2020 and a class-action lawsuit against Ledger in early 2021, users began reporting more physical phishing attempts to steal users' keys. Someone had sent the modified device to their shipping address.

Story: There was a run on IronFinance, and the price of the token went from $60 to zero in 24 hours

Abstract:According to an official statement, the run started when some large players withdrew liquidity from the Iron /USDC pool and sold $TITAN - >. $IRON -> $USDC, instead of redeemable Iron, causes the latter's price to unanchor.

Story: The first known malicious attack on Thorchain

Abstract:One attack cost Thorchain $140,000 because of a bug in the logic used to handle duplicate symbols. The network was disrupted by nodes and was patched and restored six hours later. Thorchain soon learned of the attack and claimed that they would fully compensate for the loss.

To observe the

If we compare what we see in 2020, it seems that the industry as a whole has a lot of room for improvement, perhaps forever. We need to keep educating people about DeFi "soha", DeFi admin key, the risks of phishing, and the inherent risks of putting your assets on a centralized exchange.

Comparing the first half of 2020, we can see that centralized exchanges and their security have indeed improved, at least with fewer reported hacks on their infrastructure. That's a good thing, but it also raises the question: Where are those bad guys going? A simple, and probably reasonable, guess is that they turned their attention to the DEFI protocol and infiltrated the community, making an easy escape, which, after all, does not have a high technical barrier to entry and is very profitable.

We are also seeing a rise in interest in NFT, including the big name companies taking over NFT (Christies, eBay and Sotheby's). We can predict that there will be some brutal NFT heists - either happening or not breaking out.

Hope the rest of 2021 is calm!