US$60 million was stolen from the Blast ecological project, and social engineering was "understood" by North Korean hackers

The team was lurked by hackers, and US$60 million was stolen from the Blast ecological project

This morning, Munchables, the staking game project that won the Blast Big Bang game category, announced It was attacked. At the same time, according to Pidun monitoring, there was a problem with the Munchables locking contract, and 17,400 ETH (approximately $62.3 million) had been stolen.

Subsequently, an investigation by on-chain detective ZachXBT revealed that the attack originated from The developer of the Munchables protocol is a North Korean hacker.

Slow Mist founder Yu Xian posted an explanation on social media, "This is at least the second such situation that Slow Mist has encountered in a DeFi project. Core The developer has been lurking in disguise for a long time and gained the trust of the entire project team. When the time comes, he will strike without mercy. I am afraid there will be many victims."

ZachXBT found that four different developers employed by the Munchables team have been linked to the attackers and are likely all the same Individuals, they recommended each other to do this work, and regularly transferred payments to the same two trading platform deposit addresses. The wallets of the "four people" had mutual transfer behavior.

North Korean hackers’ usual tactics: trust attacks targeting developer teams

North Korean hackers may be The most notorious presence in the crypto space. The Lazarus Group, the most well-known North Korean hacker group, has stolen $30 billion in cryptocurrency over the past six years, and the group stole $1.7 billion in cryptocurrency in 2022 alone, according to a report by cybersecurity firm Recorded Future.

Unlike technical hackers who exploit protocol technology vulnerabilities, North Korean hackers often target the development team behind the protocol, abusing trust and waiting for opportunities to steal, just like this Munchables was attacked.

The Google security team discovered in 2021 that Lazarus would lurk in social media such as Twitter, LinkedIn, and Telegram for a long time, using false identities to pretend to be active vulnerability researchers in the industry Experts, gain trust in the industry to launch 0day attacks on other vulnerability researchers.

Researchers at security firm Mandiant inc. have said they found information on a suspected North Korean job seeker in 2022 that was almost identical to other job seekers. Information, hackers have been able to apply for jobs at some cryptocurrency companies in the United States by copying job information on Linkedin and Indeed.

In addition to hackers pretending to be developers and lurking in teams, North Korean hackers will also disguise themselves as customers or employers to approach team developers.

In 2022, Axie Infinity game sidechain Ronin was stolen for US$600 million, which was the largest theft in the encryption field. Initially, Ronin's team found that the reason for the theft was that the validator node was attacked. Later investigations found that the North Korean hacker group Lazarus Group forged a company and pretended to be an employer to contact Axie Infinity developer Sky through LinkedIn in the name of high-paying recruitment. A senior engineer at Mavis.

Faced with attractive high salaries, senior engineers at Axie Infinity showed interest in "job opportunities" and went through multiple rounds of "interviews." During one of the "interviews," the engineer received a PDF file containing details about the job.

However, the file essentially gave hackers an entry point into Ronin's system. The employee downloaded and opened the file on a company computer, launching a chain of infection that allowed hackers to break into Ronin systems and take control of four token validators and an Axie DAO validator.

This kind of attack is called APT attack. Slow Mist MistTrack once summarized this attack method: the attacker first disguises his identity and deceives the auditor through real-person authentication to become Real customers, then make real deposits. Under the cover of this customer identity, when multiple official personnel communicate with the customer (attacker), the Mac or Windows custom Trojan will precisely target the official personnel. After gaining permission, they move laterally across the intranet, lie dormant for long periods of time, and then steal funds.

Back to this incident, after Munchables announced that it had been stolen, the Blast ecological DeFi protocol, which is related to the Munchables protocol, announced that it was assessing the damage caused by the vulnerability. Lucky What is interesting is that the hacker only stole ETH, and the WETH deposited by the user was not affected. Another Blast ecosystem protocol is also announcing that it will airdrop points to those affected by the Munchables attack.

Aavegotchi founder CoderDan later posted on social media posted: "Aavegotchi's development team Pixelcraft Studios hired a Munchables attacker for a short period of time in 2022 to perform some game development work. His skills were very rough and he really felt like a North Korean." Hacker, we fired him within a month. He also tried to get us to hire a friend of his, who was probably a hacker as well."

Afterwards, the github address of the suspected hacker was also made public. Perhaps due to the pressure of tracking from all parties, the hacker has now returned the stolen funds. Blast founder Pacman posted on social media that Blast core contributors have obtained $97 million in funds through multi-signatures and thanked the former Munchables developer for choosing to return all funds without the need for a ransom. All development teams, whether affected or not, must learn from this and take precautions to keep the protocol secure.

In the dark forest of the encryption world, hidden dangers are hard to guard against. Both users and project parties need to be vigilant and take adequate security precautions.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia