Binance Smart Chain halts after $570 million bridge exploit

October 6, 2022

Binance Smart Chain halts after $570 million bridge exploit

Binance Smart Chain, the relatively popular blockchain that Binance is trying to rebrand as "BNB Chain", was halted when an attacker exploited "BSC Token Hub", the bridge between the old Binance Beacon Chain and BSC. The attacker successfully moved around $127 million of the stolen crypto assets off the chain before it was paused. The attacker's wallet contained 2 million BNB, valued at $586 million based on the price at the time of the hack, but as a result of the chain halt, they were not able to exfiltrate the entire amount.

Binance CEO Changpeng Zhao ("CZ") tweeted that "An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC." A BSC developer later confirmed that "we coordinated with validators to temporarily suspend BSC after having determined an exploit on a cross-chain bridge, BSC Token Hub- which resulted in extra BNB". The value of the $BNB token dropped from $293.10 to $280.40 after the news.

The chain operators and CZ seemed to feel a little awkward about the ramifications of unilaterally deciding to halt a supposedly decentralized blockchain. CZ claimed he was asleep and that the chain had already been halted by the time he woke up. The BSC team published a blog post saying that "Decentralized chains are not designed to be stopped, but by contacting community validators one by one, we were able to stop the incident from spreading. It was not that easy as BNB Smart Chain has 26 active validators at present and 44 in total in different time zones. This delayed closure, but we were able to minimize the loss." They also promised to try to decentralize the project even further going forward.

October 5, 2022

South Korea reportedly freezes $39.6 million in crypto belonging to Terra founder Do Kwon, Kwon says it isn't his

South Korean prosecutors have reportedly frozen $39.6 million in crypto assets belonging to Do Kwon, the founder of Terraform Labs and creator of the failed Terra blockchain project. South Korea had also previously issued a warrant for his arrest.

Kwon claims that the report is a "falsehood", and "I don't know whose funds they've frozen". This joins his other claims, such as that he is "not 'on the run' or anything similar" (he is), and that Interpol didn't issue a red notice for him (they have).

"Terraform Labs founder Do Kwon refutes reports about his funds getting frozen", TechCrunch

October 5, 2022

Zcash continues to suffer from spam attack that started months ago

(attribution)

Zcash is a privacycoin which, unlike popular blockchains like Bitcoin and Ethereum, allows users to obscure who they are sending money to and how much. Since June or July, the network has been suffering from a spam attack in which attackers have been submitting massive transactions that quickly fill up block space. The chain has exploded in size, nearly tripling to more than 100GB since the attack began. Unlike other chains which are prohibitively expensive to attack, each spammed transaction costs less than a cent, and the attacker is estimated to be spending roughly $10 a day to execute the attack.

October 4, 2022

More than $1.1 million stolen from Sovryn defi protocol

(attribution)

Bitcoin-based defi protocol, Sovryn, lost $1 million to a price manipulation attack. An exploiter was able to use the project's legacy lend and borrow functionality to maliciously withdraw 44.93 RBTC (~$915,000) and 211,045 USDT.

According to the protocol, their developers "were able to identify and recover funds as the attacker was attempting to withdraw the funds". They have also announced that Exchequer, the project's treasury committee, would "reinject" the remaining stolen funds.

"Bitcoin Defi Protocol Sovryn Gets Hacked for Over $1 Million", CryptoPotato
"Interim Exploit Update", Sovryn

October 3, 2022

Buyer and seller of hacked account logins busted for $1 million tax fraud

A Floridian who was in the business of buying and selling hacked account logins on the dark web was busted for attempted income tax evasion when he tried to hide more than $1 million in crypto earnings from the IRS in 2014–2017. Despite using services like cryptocurrency mixers (or "tumblers"), the man was unable to successfully hide the money from the IRS. He faces up to five years in prison for the tax fraud. Remember, folks, always make sure to report your ill-gotten profits to the IRS!

"Non-Payment of Federal Income Tax on Cryptocurrency Earnings Leads to Conviction for South Florida Resident", U.S. Attorney's Office of the Southern District of Florida

October 3, 2022

Kim Kardashian pays $1.26 million fine for promoting a cryptocurrency without sufficient disclosure

Instagram story post from Kim Kardashian, which reads "Are you guys into crypto???? This is not financial advice but sharing what my friends just told me about the Ethereum Max token! A few minutes ago Ethereum Max burned 400 trillion tokens—literally 50% of their admin wallet giving back to the entire E-Max community. SWIPE UP"

Kim Kardashian's Instagram post (attribution)

Kim Kardashian agreed to settle with the SEC over allegations that she had promoted a "crypto asset security" without disclosing how much she had been paid, or when. In June 2021, Kardashian posted an ad to her Instagram story where she claimed that she was "sharing what my friends just told me about the Ethereum Max token". Although she did include "#ad" in the post, she did not disclose to her 251 million followers that she was being paid $250,000 to post it — a requirement if they decide to post ads pertaining to securities investments. She will pay $1.26 million in the settlement.

SEC Chair Gary Gensler said, "Ms. Kardashian's case also serves as a reminder to celebrities and others that the law requires them to disclose to the public when and how much they are paid to promote investing in securities".

Kardashian is also named in an ongoing class action lawsuit pertaining to the EthereumMax project, along with Floyd Mayweather and Paul Pierce.

"SEC Charges Kim Kardashian for Unlawfully Touting Crypto Security", U.S. Securities and Exchange Commission

October 2, 2022

Coinbase experiences major outage related to U.S. bank accounts

(attribution)

The largest crypto exchange in the U.S., Coinbase, suffered a six-hour-long outage in which they couldn't take payments or make withdrawals involving U.S. bank accounts. They later narrowed down the problem to an issue creating ACH transfers, and tweeted "rest assured, your funds are safe". Six hours later, the company marked the incident as resolved.

"Coinbase Suffers 'Major Outage' for Customers With US Bank Accounts", Decrypt

October 1, 2022

Transit Swap hacked for $21 million, hacker returns large portion

(attribution)

Transit Swap is a multi-chain decentralized exchange aggregator. Users of the project were collectively exploited for approximately $21 million when an attacker took advantage of a bug in the project's smart contract that allows arbitrary external calls. The attacker used this vulnerability to steal tokens that had been approved for swap by Transit Swap users. Amusingly, the hacker lost about $1 million of their ill-gotten funds to a MEV bot that was able to successfully front-run the swap.

Multiple cryptocurrency security companies collaborated to investigate the hack shortly after it occurred. Transit Swap announced that "through the joint efforts of the SlowMist security team, the Bitrace security team, the PeckShield security team, the TokenPocket team and the TransitFinance technical team, we now have a lot of valid information such as hacker's IP, email address, and associated on-chain addresses." They subsequently announced that the attacker had returned around 70% of the stolen funds ($14–$15 million).

"Transit Swap", Rekt
"Cross-chain DEX Aggregator Transit Swap Hacked Analysis", SlowMist
Tweet by TransitFinance

September 30, 2022

NFT trading fantasy league emerges to provide traders with the "sweet adrenaline" of flipping NFTs that they're missing in the bear market

(attribution)

"Most of us are too poor to be spending the [ether] we have left on huge sweeps, but we still want that sweet adrenaline rush of flipping JPEGs" said Brian Krogsgard, co-founder of the Flip NFT platform, in a statement you would think might have raised a red flag or two in his own mind. Evidently NFT traders are now being pitched NFT trading fantasy leagues, where they will be able to paper trade NFTs without risking their real-life fake money. Unfortunately for the traders, the app uses actual NFT price data, so the huge NFT project bull runs that some traders experienced during the NFT mania of 2021 will likely not emerge here, either.

"Beleaguered NFT Traders Can Now Relive Mania With Fantasy League Game", CoinDesk

September 30, 2022

One misconfigured node apparently takes the entire Solana network offline

(attribution)

In the latest illustration of our marvelous new decentralized, resilient blockchain future, one single Solana node apparently was able to take down the entire Solana network. Solana outages are nothing new, and tend to end (as this one did) with Solana issuing instructions to the people who run their validators, asking them all to turn them off and on again.

A validator operator reported that "It appears a misconfigured node caused an unrecoverable partition in the network." It's a bit startling that, in a supposedly decentralized network, one single node can bring the entire network offline.

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.