According to Chengdu Chain Security [Chain Bian – Blockchain Security Situational Awareness Platform (Beosin-Eagle Eye)] security opinion monitoring data: In June 2021, according to incomplete statistics, there were more than 36 typical security incidents in the blockchain ecology, and the overall security risk rating was [high]. This month, [DeFi] is still the main position where typical security incidents occur frequently, and “lightning loan attack” is still the main attack method adopted by hackers. In addition, the security posture of [fraudulent runway/encryption scam] is also serious and should not be taken lightly.
As the DeFi ecosystem tends to flourish, various DeFi projects are exposed to different security risks due to their different product designs and implementations. For example, in the xWin Finance hack, the attackers exploited the vulnerabilities in the project’s “promotion tools and rewards mechanism” to launch the attack; while in the SafeDollar hack, the attackers exploited the vulnerabilities in the project contract’s “collateral and calculation In the SafeDollar hack, the attackers exploited a flaw in the logic of the project contract in the “collateral and calculation of rewards”.
Here are the details of this month’s monthly security report.
On the exchange side
There were ‘2’ typical security incidents
The South Korean authorities’ new rule that trading platform staff who trade on their own platform will face a fine of up to 100 million won (about $90,000) and suspension of trading license.
The South Korean police arrested four people, including the representative of virtual currency trading platform “V Global”, A. and the operator, for allegedly violating the law on restricting illegal credit practices and fraud.
There were 11 typical security incidents
PancakeHunny was hacked and a large number of tokens were issued and dumped into the market within a short period of time.
SushiSwap helped Alchemix discover a vulnerability that could siphon ALCX from their rewards contract, which led Alchemix to request SushiSwap to disable their “double mining rewards”.
Earnings farm EvoDefi was attacked, causing its token GEN price to drop 57% from $2.10/coin to $0.90/coin.
DeFi fixed rate generation protocol, 88mph, releases a fix for a serious vulnerability in the init( ) function.
Alchemix alETH pool is suspected to be vulnerable and users can raise collateralized ETH without paying alETH debt. the team has now stopped collateralized lending to the pool and launched an investigation.
DeFi protocol Impossible Finance is suspected to be under a lightning lending attack.
Eleven Finance’s Nerve-related machine gun pool may have been attacked by lightning lending, and the Nerve Finance team says the funds are safe.
On June 25, the DeFi protocol xWin Finance on the BSC chain was attacked by lightning lending.
On June 28, SafeDollar was suspected to have been hacked and an unconfirmed contract siphoned off $250,000 in USDC and USDT.
THORChain suffered a malicious attack which caused a loss of $140,000 in funds, but THORChain said user funds will not be affected and will use the funds pool to cover the vulnerable funds.
Gain aggregator Merlin Lab, which was hacked due to a logic flaw in MerlinStrategyAlpacaBNB, where the flaw was that the contract mistakenly used WBNB transferred by gainers as mining proceeds, causing the contract to issue more $MERL increments as rewards.
This month, the typical security incident on DeFi’s side surpassed the “10” mark, and the security posture remains critical. Reasons such as lightning credit attacks, business logic vulnerabilities, and project reward mechanisms have all become “cracks” for hackers to launch attacks, so as a project owner, remember to focus on the design and implementation of the project itself. If necessary, you can use the power of third-party security companies to carry out self-inspection of the project to eliminate possible security risks.
Fraudulent runway/encryption scam
8 typical security incidents occurred in total
On June 1, two men suspected of running a scam through the Bitcoin peer-to-peer platform LocalBitcoins were detained. Nearly 36 people and approximately $136,000 in virtual currency were defrauded in the scam.
On June 12, Twitter users reported receiving emails from the scam team, which opened the Microsoft Word logo scr file attached to them, and were subsequently attacked.
A man in Nottinghamshire, England, claims to have had £200,000 (about $282,000) stolen by a fake brokerage firm in a crypto scam.
StableMagnet Finance, an automated market maker for stablecoin exchanges on the Coin Smartchain (BSC), ran away after rolling up $22 million from users.
The founder of Africrypt, a virtual currency investment platform, lost contact and 69,000 bitcoins (about $2.3 billion) were transferred from the platform.
On June 24, the Xichang Public Security Bureau, in the course of strengthening the fight against telecom network fraud crimes, broke up the first gang that used virtual currencies to “launder” money for telecom network fraud crimes.
Europol cracked down on the Belgian Ponzi scheme Vitae, in which law enforcement officers recovered 1.1 million euros in cash and 1.5 million euros in virtual currency.
A scammer posing as virtual currency analyst PlanB tweeted about the scam, and many people had their money stolen.
In the past two months, the number of typical security incidents [in terms of scam runs/crypto scams] has remained high, which shows that virtual currency scams have become more and more of a “black sheep” affecting the entire blockchain security ecosystem. The increasing security situation not only seriously threatens the safety of users’ property, but also brings great resistance to the development of the blockchain industry as a whole, which is worth raising alarm!
A total of 4 typical security incidents occurred
The U.S. Department of Justice recently charged Latvian citizen Alla Witte with participating in an international cybercrime organization that created and deployed a set of computer banking ransomware called Trickbot in an attempt to defraud consumers, businesses and other organizations.
The United States recovered millions in virtual currency previously paid to the Colonial Pipeline ransomware hackers.
Andre Nogueira, CEO of JBS USA Holdings, the U.S. subsidiary of Brazilian meat processing JBS SA, said the company has paid an $11 million ransom to cybercriminals to resolve a ransomware attack.
The Monero malware “Crackonosh” has infected 222,000 computers.
A total of ’11’ typical security incidents occurred
On June 3, Apple co-founder Steve Wozniak sued YouTube last July, accusing the platform of letting others use his image to post bitcoin scam videos, and the lawsuit was dismissed by a California court on Wednesday.
Eleven users of South Korean virtual currency exchange Upbit filed a class action lawsuit against its operator Dunamu Inc. seeking compensation for the loss of funds due to a suspected technical glitch.
The official website of Sri Lanka’s prime minister was compromised by an anonymous hacker group and redirected to another website called decentralized virtual currency Bitcoin.
SiaStats tweeted that the Sia network has been under DDoS attacks for the last 48 hours, with the biggest targets being network hosts, storage providers, and about 30% experiencing outages.
DeFi asset management platform Zapper tweeted that it found a vulnerability in an older version of the “Polygon Bridge” smart contract that allows attackers to steal unlimited approved funds.
A Twitter user said that a $1 million USD/ETH transaction on Curve had higher slippage than a $10 million USD/ETH transaction, suspected to be caused by a routing error. The vulnerability has now been fixed.
Mumbai resident Makarand Pardeep Adivirkar was arrested by India’s Narcotics Control Bureau (NCB) for what he called the “crypto king” of the country’s underground drug cycle, and Indian virtual currency exchange Wazirx said the accused was not a customer.
Algorithmic stablecoin protocol Malt Protocol unveiled a plan to compensate investors affected by vulnerabilities that prevented the launch of the protocol and locked out liquidity providers.
A tax official named Hwang Byung-gwang, whose keen investigative skills led to the recovery of up to $32 million in tax funds, was honored by the National Tax Service with the title of “Outstanding Civil Servant.
Security firm Fireblocks responded to the loss of $75 million worth of Ether from StakeHound, saying its incident was caused by StakeHound’s failure to use a third-party disaster recovery service to back up BLS keys as required, which was communicated in writing when the two parties entered into the agreement.
On June 29, Natwest Bank in the United Kingdom limited the amount of money customers can send to virtual currency exchanges (including Coinan) on a daily basis due to concerns about investment scams and fraud.
Given the current security posture of the blockchain ecosystem, ‘Chengdu Chain Security’ hereby summarizes.
In general, typical security incidents in June were slightly higher than in May, and the security posture of the entire blockchain ecosystem remains at [a high risk level]. It is easy to see that the distribution of security events in June, [DeFi] and [fraudulent runner/crypto scam] still need the attention of blockchain practitioners.
In terms of DeFi, with the continuous development of DeFi ecology, various kinds of DeFi projects are springing up, and the higher the concentration of assets on the chain and the wider the coverage of users, the more they will naturally become the targets of hackers. The Chengdu Chain Security Team recommends that all DeFi projects must do a good job of security audit and security prevention.
In terms of [fraudulent runaway/crypto scam], with the rapid expansion of the virtual currency market, all kinds of fraudulent and runaway criminal activities are increasingly rampant. Chengdu Chain Security – Seven Stars Lab has noticed that more and more unscrupulous elements have recently started to use virtual currencies to carry out illegal and criminal activities such as fraud, pyramid schemes, money laundering, and online gambling, etc. It is recommended that investors do not follow blindly and gullibly, and avoid falling into the traps “carefully prepared” by unscrupulous elements.
Posted by:CoinYuppie，Reprinted with attribution to:https://coinyuppie.com/over-36-typical-security-incidents-in-june-defi-and-virtual-currency-fraud-security-risks-remain-high/
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.