Partnered With:

Unibot suffered a loss of over $600,000 due to an attack, raising concerns about the security of TG BOT.

Read this article in 8 Minutes

Router vulnerability detected, attacks are still ongoing.

Original Title: "Unibot suffers over $600,000 in losses from attack, security of TG BOT in doubt"

Original Source: Odaily Star Daily

This afternoon, several community members reported that the Telegram Bot project Unibot has been attacked. According to Scopescan monitoring, the attacker transferred tokens from Unibot users and is currently exchanging them for ETH. The current loss has exceeded $600,000.

Upon the release of the news, the token UNIBOT dropped from its lowest point of 55 USDT to 33 USDT, with a maximum decline of 40%, and is currently trading at 39.5 USDT.

Security Company: Cancel Authorization as Soon as Possible

The security organization BlockSecTeam believes that due to the code not being open source, it is suspected that the function 0xb2bd16ab in the 0x126c contract lacks input verification, allowing for arbitrary calls. Therefore, attackers can call "transferFrom" to transfer approved tokens from the contract. BlockSecTeam reminds users to revoke contract approvals as soon as possible and transfer funds to a new wallet.

Beosin security team analysis believes that the root cause of the Unibot attack is CAll injection. Attackers can pass custom malicious call data to the 0xb2bd16ab contract, thereby transferring tokens approved by the Unibot contract. Beosin Trace is tracking the stolen funds, and Beosin reminds users that they can cancel wallet authorization on Revoke, link: https://revoke.cash/. The attack-related address is as follows: https://eagleeye.space/address/0x413e4Fb75c300B92fEc12D7c44e4c0b4FAAB4d04

黑客蛰伏半年进行攻击

translates to

Hackers lurked for six months before launching an attack

This time, the Unibot incident was a bit strange in that the hacker address had been monitoring it since the deployment of the Unibot contract in May of this year. According to Scopescan monitoring, the hacker received 1 ETH as Gas for this attack from FixedFloat (a mixer) one week after Unibot was launched, and there was no related activity for the next six months until today's attack.

Many users in the cryptocurrency community speculate that this attack may have been carried out by an insider at Unibot, as the timing of the incident was very coincidental, happening during the window period after Unibot had just upgraded to a new contract two days prior. The hacker was able to easily exploit a vulnerability in the contract.

：

On-chain information shows that the remaining assets in the hacker's wallet address are currently about $630,000, with the largest proportion of remaining assets being ETH, which is approximately $573,000. Other stolen assets involve the following currencies.

According to Lookonchain's monitoring, a user had their assets stolen twice during this attack. The user initially received 20,789 USDC and spent 1000 USD to purchase SMilk, leaving 19,789 USDC in value that was stolen by the attacker without the user noticing. This afternoon, the user sold SMilk for 2,194 USD and earned 1,194 USD (a return rate of 120%). One hour later, the remaining 2,194 USD of USDC was stolen again.

Router vulnerability discovered, attacks still ongoing

Unibot official announcement stated that the main cause of this attack was a token approval vulnerability found in a new router. The router has been temporarily suspended. Any financial losses caused by this vulnerability will be compensated, and Unibot will provide a detailed response after the investigation is completed.

Community user @tomkysar said that the attack on Unibot is still ongoing, and two attacker addresses seem to still be able to obtain funds from approved addys at 0x126 Router, posing a risk to user funds.

BOT Product Security Doubtful

Unibot is a popular new Telegram Bot that allows users to trade cryptocurrencies without leaving the Telegram application. The robot is easy to use, has fast transaction speeds, and offers various features such as decentralized copy trading, limit orders based on DEX, and protection against MEV robots.

According to CoinGecko data, since its establishment, UniBOT has earned 8950 ETH, ranking second among all BOT products; Maestro ranks first with a total revenue of 13,200 ETH; Banana Gun ranks third with a revenue of 1940 ETH.

However, BOT products also have significant security risks, especially recently, the Maestro contract also experienced the same router vulnerability, resulting in a loss of about 281 ETH. This vulnerability allows attackers to transfer any approved tokens on their router 2 contract (https://etherscan.io/address/0x80a64c6d7f12c47b7c66c5b4e20e72bc1fcd5d9e…). In the end, Maestro chose to compensate users for part of their losses.