Partnered With:

Slow Fog: Blockchain security incidents in 2021 cost more than $9.8 billion

Read this article in 37 Minutes

By ecology, ethereum lost the most, followed by BSC ecology. From the field of attack, exchanges and DeFi are the most attacked.

Slow Fog: A review of the blockchain security ecosystem in 2021, with global losses exceeding $9.8 billion

原文来源：慢雾 AML

2021 has been a year of ups and downs for the blockchain industry. However, with its decentralized, open and transparent characteristics, blockchain has still achieved good results with the efforts of both inside and outside the industry. At the same time, after DeFi, the crazy upsurge of global users and media on NFT and meta-universe has brought blockchain to an unprecedented height. What happened this year? This article will take you to explore from the development of blockchain market and typical security events.

Blockchain ecological security situation

Policy, compliance and supervision

From the perspective of the domestic environment, on the one hand, the government has increased the emphasis on the RESEARCH and development and application of blockchain technology, and the Ministry of Industry and Information Technology has pointed out that the service capacity of blockchain and other facilities will be significantly enhanced by 2025. On the other hand, governments continue to tighten regulations on cryptocurrencies. In September, multiple departments issued a Notice on Further Preventing and Disposing of risks of Speculation in Virtual currency transactions, and the National Development and Reform Commission and other departments jointly issued a Notice on Regulating virtual currency "Mining" activities. According to relevant materials, policy documents related to block chain will be issued at the national level in 2021, covering university research, talent cultivation, technology application standards, intellectual property rights, digital agriculture, shipping and transportation, epidemic prevention and control, network security, social assistance, digital cultural industry and other aspects.

From the perspective of foreign environment, governments of all countries are still paying constant attention to cryptocurrencies, gradually improving the supervision of cryptocurrencies, and gradually liberalizing policies. The Financial Action Task Force of the Global Anti-money Laundering Body publishes updated regulatory guidelines for cryptocurrencies; Seoul, South Korea will build a "meta-universe platform" for public services; Texas virtual currency Bill has officially come into effect; Bitcoin became legal tender in El Salvador; The Ukrainian Parliament passed a bill on virtual assets.

It can be seen that governments around the world attach greater importance to blockchain, and as an important part of "new infrastructure", blockchain is being embraced by more and more mainstream institutions.

2. Technology, application and economy

China's "blockchain + industry" is also developing steadily, with various application projects constantly emerging. China's first blockchain intellectual property protection workstation was inaugurated; Guangdong province issued the country's first public data asset certificate. Giant companies also joined the track: Huawei opened the "security chip and processing method" patent, Tencent cloud blockchain released three products, Baidu added "blockchain system upgrade method, device, equipment and storage media" patent; The China Mobile Communications Federation Yuan Space Industry Committee was formally established; China ranks first in the number of blockchain patent applications in the world, accounting for about 63%. Mofcom said it will promote the standardized application of new technologies such as blockchain.

In 2021, the underlying technology of blockchain also achieved a key breakthrough. Ethereum is expected to merge in Q2 2022. V God et al proposed IP-4488 to reduce Gas for ethereum's two-tier expansion solution; Ethereum Layer2 capacity expansion scheme Arbitrum & NBSP; Will launch based on &nbSP; Nitro, a new version of WASM; August 5th Ethereum completes London upgrade.

3 Security Events

Blockchain technology is a double-edged sword. Its decentralization, anonymity, imtamability and other features promote industrial progress, while causing a significant increase in blockchain security problems. There are a variety of cryptocurrency crimes, such as money laundering, fraud, theft, drug trafficking, mining and other crimes.

According to incomplete statistics on the hacked files of Slow Fog Technology blockchain, up to the time of publication, in 2021, there were 231 blockchain security incidents disclosed by blockchain ecology, with a loss of more than $9.8 billion.

(Source: hack.slowmix.io)

Among them, there were 170 ecological DApp and DeFi security incidents, 15 exchange security incidents, 8 public chain security incidents, 3 wallet security incidents and 35 other security incidents.

Overall losses have risen since 2018.

Here's a review of typical events, with a slow fog perspective on each. Although this list is only the tip of the iceberg, it is very representative.

Security incidents and perspectives

1 male chain

BSV By & have spent 51% attack

On August 4, BSV suffered a suspected 51% attack and nearly 100 blocks were reorganized.

The ETC main network suffered a fork

On September 4, Ethereum Classic (ETC) tweeted that the ETC main network suffered a fork due to a Geth vulnerability on the Ethereum client.

The mainnet Beta of Solana was hit by a denial of service attack

On September 14, the Beta version of the public chain Solana's main network began to show unstable conditions since 19:52 Beijing time. On September 21, Solana officially released a preliminary overview of the network outage: Solana's network was offline for 17 hours with no financial loss and full functionality was restored within 24 hours. The network is down because of a denial of service attack. At 12:00 UTC, Grape Protocol launched IDO on Raydium, and robot-generated transactions clogged the network. These transactions caused memory overflows, causing many validation nodes to crash, forcing the network to slow down and eventually stop.

Slow fog view

Although the security loophole of public chain causes a small loss, it has a huge impact on the whole chain ecology. So the public chain must go through a professional security audit before going online. It is recommended that the public chain team cooperate deeply with a trusted and professional security team to deploy security suggestions tailored to local conditions to minimize the possibility of causing security problems, thus ensuring the safety of the entire public chain.

2 exchange

Cryptopia has been hacked again

Cryptopia, the New Zealand exchange, was hacked again on February 20, with an investigation showing that hackers accessed a wallet that had been dormant since the January 2019 hack. The wallet belongs to Stakenet and is controlled by Grant Thornton, Cryptopia's liquidator. According to the findings, the dormant wallet held about $1.96 million worth of Xtake, Stakenet's native token.

Liquid Hot wallet attack

On August 19, Liquid, a Japanese crypto trading platform, said its hot wallet had been attacked. According to the analysis and statistics of MistTrack anti-money laundering tracking system under slow Fog AML team, Liquid lost a total of about 91.35 million US dollars (according to the price on the day of the incident), and more than 70 kinds of stolen currencies involved BTC, ETH, ERC20 token, TRX, TRC20 token, XRP and so on. The number of coins, the amount of high, amazing.

Slow fog view

The security of exchanges has become the primary concern of exchanges and users, and even the key to the survival of exchanges. In particular, in the fourth quarter of this year, various exchanges suffered a series of attacks, causing heavy losses.

Exchanges are frequently attacked for the following reasons :(1) exchanges gather a large amount of money, which has always been the target of hackers; (2) In most cases, exchanges are vulnerable to security loopholes and hackers are easy to penetrate into them. (3) Users lack sufficient security awareness; (4) Internal crimes.

For exchanges, it is suggested that all major exchanges improve their internal management and technical mechanisms, and introduce security audit mechanism, zero-trust mechanism, and hot and cold asset security solutions to strengthen the security guarantee of digital assets. At the same time, actively welcome supervision. For users, we must strengthen security awareness, do not leak the private key to anyone at any time, at the same time, look for the official platform, to avoid the occurrence of phishing events.

3 the purse

Ledger wallet has been leaked for many times

On June 18, Ledger, the provider of bitcoin hardware wallets, alerted users to a series of new scams using fake Ledger hardware wallets to defrauds users of their assets. Some users whose information was compromised a year ago received packages requiring users to replace their hardware wallets. The package included a fake official letter and a tampered Ledger hardware wallet.

Ledger said the letter about the need to replace existing hardware wallets to protect your money was a hoax, and that the Ledger Nano accompanying the letter was a fake. If users typed the seed words as described in the letter, their encrypted assets would be stolen.

Multiple Chivo wallets were stolen

The Chivo wallet is a national digital wallet launched by the Government of El Salvador on September 7 to promote the Bitcoin law. To this end, El Salvador promises users who download and authenticate the Chivo wallet will receive $30 in Bitcoin. The move helped the Official Salvadoran wallet reach more than 2 million users within a month. However, between October 9 and October 14, El Salvador's human rights organization Cristosal received 755 notices from Salvadorians reporting identity theft from Chivo's wallet.

Slow fog view

While the number of incidents related to the wallet itself is down this year, the number of thefts caused by downloading fake wallet apps is huge. According to a November report by Manfog, tens of thousands of people have been stolen from fake wallet apps, costing $1.3 billion. Developing security awareness and having the right tools can really protect your assets. First of all, check the official website and don't click on links other than the official website; Second, do a good wallet backup and secure the private key mnemonic; Finally, always be skeptical. There's no such thing as a free lunch.

DApp, DeFi, NFT, cross-chain

(1) ETH ecology

SushiSwap was attacked again

On January 27, SushiSwap was attacked again, losing 81 ETH. This attack was similar to SushiSwap's first attack, in that it manipulated the exchange price of trading pairs to generate profits. This attack takes advantage of the fact that DIGG does not have a transaction pair for WETH, and the attacker creates this transaction pair and controls the initial transaction price, resulting in a huge slippage in the process of commission exchange. The attacker can obtain huge profits by using a small amount of DIGG and WETH to provide initial liquidity.

$12.15 million recovered after SIL theft

On March 19, DeFi's converged wealth management service sil. Finance contract suffered a high-risk vulnerability. Sil.finance later posted that the incident was caused by a smart contract permissions vulnerability, which in turn triggered a universal front-runner bot to submit a series of trades for profit. After finding that the smart contract could not be withdrawn due to high-risk vulnerabilities, after 36 hours of efforts by multiple parties including Slow Fog, it has successfully recovered 12.15 million US dollars.

(2) BSC ecology

Compound Loopholes and Proposals

On September 30, The decentralized lending agreement Compound confirmed via Twitter that liquidity mining for the agreement experienced a COMP token distribution anomaly following the implementation of Proposition 62, and that Compound Labs and community members are investigating. Compound said deposits and borrowed funds are not currently at risk. According to Compound founder Robert Leshner, the problem appears to be that too many COMP tokens were distributed due to an incorrect initial setting of the rate at which COMP tokens were distributed under Proposition 62. On October 4, just as Compound was trying to fix the bug, another $68.8 million in COMP tokens (202,472 comPs in total) was put into the already compromised liquidity mining token distribution contract due to calls to the Drip () function.

Cream Finance was attacked three times

On Oct. 27, DeFi lending association Cream Finance was attacked, losing about $130 million. The stolen funds were mainly Cream LP tokens and other ERC-20 tokens. It is believed to be the third largest DeFi hack ever. Cream Finance has also been hit by lightning loan attacks before, losing $37.5 million in February and another $19 million in August.

(3) EOS ecology

Flash. Sx smart contract is under reentrant attack

Starting at 11:28 UTC on 14 May, flash.sX smart contracts suffered a "re-entry" vulnerability, which resulted in the theft of approximately 1.2 million EOS and 462,000 USDT. According to the official news, after EOS Nation's Lightning loan was hacked, the project party initiated a proposal to directly change the permission of the hacker'S EOS account and transfer it back to the asset.

PIZZA was hacked

At 8 p.m. on December 8, the hacker account ItsSpiderman took advantage of the overflow vulnerability to issue tripool market-making certificates out of thin air on eCurve, where PIZZA pledged and lent out most of the tokens in the agreement. More than 1.3 million accounts were created and the stolen assets dispersed. PIZZA Protocol lost about $5 million in the attack.

(4) Polygon ecology

SafeDollar, an algorithm stablecoin project, was attacked

On June 28, SafeDollar, an algorithm stablecoin project on Polygon, was suspected of being hacked, with an unverified contract that appears to have siphoned off $250,000 of USDC and USDT.

PolyYeld Finance contract was utilized

Revenue farming agreement PolyYeld Finance was attacked and the project contract was used to mint 4.9 trillion YELD tokens and dump them on the secondary market.

(5) HECO Ecology

HSO ran away with 30,000 HT

On March 10th, THE prophet project HSO on Huobi ecological chain HECO carried out IDO, and 30,000 HT ran away. The website and Telegram could not be opened. Later, with the full efforts of HECO core coding contribution team star Lab, HECO technical community, HECO White Hat Safety Alliance and other relevant parties, 24823 HT has been recovered.

XDX Swap is attacked

On July 2nd, XDX Swap (DDEX), a decentralized exchange on Heco chain, was attacked. The attacker gained 85.17 ETH (about $176,000) and transferred all of it across the chain to Ethereum. The DDEX code is suspected to have a backdoor. With the support and cooperation of DDEX, Star Lab, HECO White Hat Security Alliance and other parties, XDX Swap recovered most of the funds involved in this attack, with a total value of more than $5 million.

(6) Other ecology

NEAR ecology ref. Finance was used due to contract error

On 14 August at around 2 PM UTC, the Ref team noticed unusual behavior in the Ref-NEAR trading pair and immediately discovered an error in the patch for the recently deployed contract. In addition, this error has been used by many users, resulting in about 1 million refs and 580,000 NEAR being affected.

Solana Ecology Solend has been hacked

Solana eco-loan protocol Solend tweeted on August 19 that the protocol was hacked at 20:40 Beijing time on August 19. The attacker cracked the UpdateReserveConfig function, which checks for insecure identities, allowing it to clear all accounts. In addition, the hackers set the APY of the borrowed funds to 250%. During this period, five users' funds were mistakenly cleared. Solend said that no money was stolen in the attack, and that it would increase the size of the bounty and establish better monitoring and alarm systems.

Polkatrain, the PLATFORM of Boca Ecological IDO, was arbitraged

On April 5th, Polkatrain, the platform of Boca Ecological IDO, had an accident. According to slow fog analysis, the contract with problems this time is POLT_LBP contract of Polkatrain project, which has a swap function and a commission return mechanism. When the user purchases PLOT tokens through swap, he or she receives a certain amount of rebate, which is forwarded to the user in the form of the _update function transferFrom in the contract. Since the _update function does not set the maximum amount of rebates for a pool and does not determine whether the total rebates have been used up at the time of rebates, malicious arbitragers can collect contract rebates by repeatedly calling swap for token exchanges.

Vee.Finance was stolen from Avalanche chain

On September 20, vee. Finance team at Avalanche chain noticed multiple abnormal transfers and after further monitoring, a total of 8804.7 ETH and 213.93 BTC were stolen (total value over $35 million). Stablecoins were partially unaffected by the attack.

GrimFinance on Fantom chain hit by lightning loan

On December 19, Fantom's on-chain compound income platform GrimFinance was hit by a flash loan attack, which has lost more than $30 million. The attacker uses a function called "beforeDeposit()" in GrimFinance's vault policy to attack, entering malicious Token contracts.

(7) cross-chain system

THORChain 3, a cross-chain trading protocol, was attacked

On June 29, THORChain was attacked by "fake recharge" and lost nearly $350,000. On July 16, THORChain was attacked by "fake recharge" twice, losing nearly $8 million. On July 23, THORChain was attacked again, losing nearly $8 million.

The Chainswap theft affects multiple platforms

On July 11, Chainswap, a cross-chain bridge project, was hacked again. More than 20 project tokens deployed in the bridge with smart contracts were stolen by hackers. The total loss is estimated to be $4 million, almost resulting in the largest security incident in the history of DeFi. According to & have spent Chainswap Investigation, due to an error in the token cross-chain quota code, the on-chain swap bridge quota is automatically increased by the signing node, which aims to be more decentralized without manual control. However, due to a logical flaw in the code, this leads to a vulnerability that automatically increases the number by allowing invalid addresses that are not whitelisted. On July 2, Chainswap was hacked and some tokens were removed from their wallets, resulting in an estimated loss of $800,000.

Poly Network $610 million was stolen and returned

The Poly Network attack on August 10 May have been the largest cyber security incident in history, with more than $610 million in crypto assets stolen and returned within 15 days. Poly Network and the entire blockchain industry, along with all relevant parties, have been through the ups and downs of this process. All assets involved have been returned to users, and system functions have recovered to the level before the event.

(8) NFT

NFT fraud spreads

On August 2, a scammer named "Cryptopunksbot" posted on the CryptoPunk Discord server, offering NFT investors the chance to win 10 NFT avatars. NFT project founder Stazie lost 16 CryptoPunk, worth at least $1 million, after accepting posters with fake offers. The fraudster then sold five CryptoPunk units for 149 ETH ($385,000).

Slow fog view

Since its birth, DeFi has been accompanied by numerous risks. While the value of many DeFi projects has been exploding and doubling, the number of hacks has also increased. According to slow fog statistics, DeFi usually has the following attack modes :(1) lightning loan attack; (2) Contract loopholes; (3) Compatibility or architecture issues; (4) private key leakage or front-end attack; (5) Commit internal crimes and run away.

For the project side, in order to eliminate vulnerabilities and reduce security risks as much as possible, it is necessary to make effective efforts -- comprehensive and in-depth security audit before the project goes online. At the same time, it is suggested that DeFi project parties increase the strength of asset protection by introducing multi-signature mechanism. On the other hand, when each DeFi project carries out interaction between protocols, compatibility between protocols is required. When migrating the code of other protocols, developers should fully understand the architecture of the migration protocol and the architecture design of their own projects to prevent the occurrence of capital loss. For users, as the gameplay in the blockchain field becomes more and more diversified, users should carefully understand the background of the project before making investment, check whether the project is open source and audited. They need to be vigilant and pay attention to project risks when participating in the project.

5 Other Types

blackmail

Colonial Pipeline, the largest operator of oil and gas pipelines in the United States, was forced to suspend operations after a targeted ransomware attack on May 7. A ransom of 75 Bitcoins, or more than $4 million, was paid to get operations back on track. The extortion attack caused shockwaves and widespread concern around the world because it involved critical infrastructure at the national level. U.S. Justice Department officials say more than $2 million in ransom has been recovered. However, administration officials did not elaborate on how to obtain the private key and recover the ransom, saying only that the operation demonstrated the United States' commitment to dealing with extortion attacks.

fraud

The founder of one of Russia's biggest cryptocurrency scams was jailed on August 20 for allegedly bilking his investors out of more than $1.5 billion. Finiko was founded in 2019 in the city of Kazan, posing as a legitimate BTC investment company. Finiko launched its native cryptocurrency, FNK, in December 2020. According to local reports, the founders will take BTC from investors and reward them with FNK tokens.

fishing

On October 15, Sophos published a report alleging that crypto-fraud app CryptoRom stole $1.4 million by using a "super-signature service" and Apple's Developer Enterprise program. To date, more than $1.39 million has been sent from bitcoin addresses linked to the scam, and more may be linked to the scheme. Most of the victims were iPhone users, the report said. CryptoRom bypasses all App Store security checks and remains active every day, according to the report. The report also said Apple "should have warned users about applications installed through temporary distribution or through enterprise configuration systems that were not reviewed by Apple."

Slow fog view

In the process of vigorously developing blockchain, all kinds of new investment scams in the name of blockchain have mushroomed in endlessly. Ransomware, for example, reached $590 million in ransomware-related transactions in the first half of 2021, according to a report by the Treasury Department's Financial Crimes Enforcement Network. Manfog here reminds users not to open email attachments of unknown origin, carefully identify phishing sites, always have a suspicious and cautious attitude, and effectively use anti-virus software.

conclusion

Although the market value of many cryptocurrencies represented by BTC has been rising, and the overall development trend of the blockchain industry is getting better and better, cryptocurrency crimes are also becoming more rampant. From the statistical data, the months with more security incidents and greater amount of loss are mainly in April, June and August. By ecosystem, ethereum lost the most, more than $1.3 billion, followed by BSC Ecosystem. From the field of attack, exchanges and DeFi are the most attacked.

For the project side, it is suggested to improve the internal management and technical mechanism, and internal security personnel timely check and fill the gaps in safety-related content. The most important and effective way to minimize the possibility of security issues is to conduct a thorough and in-depth security audit of a project before it goes live.

For users, a correct and rational view of blockchain, establish a correct currency concept and investment concept, and effectively improve the awareness of risk prevention. For example, before investing, we should pay attention to whether the smart contract is open source, whether the platform itself has security audit, and most importantly, we must keep our private key mnemonic and do not disclose it to anyone.

Last but not least, we look forward to seeing greater energy burst out of blockchain in the New Year, with more applications and greater value created.