Blockchain security firm CertiK suffers compromise of their own

January 5, 2024

Blockchain security firm CertiK suffers compromise of their own

The Twitter account of the blockchain security company CertiK was hacked, then used to post tweets ostensibly warning of a massive crypto vulnerability and urging users to click a link to protect their wallets, but which instead linked the account's some 340,000+ followers to a site that would drain their wallets if connected.

CertiK quickly regained control of the account and deleted the tweets, later explaining that an employee had been contacted by a "verified account, associated with well-known media". The journalist's account, apparently compromised, successfully phished the CertiK employee by sending what looked like a Calendly meeting scheduling link, but what was in fact a malicious link used to take over the CertiK Twitter account.

Blockchain sleuth zachxbt criticized CertiK, which describes itself as a leading blockchain security firm, for not protecting against the attack, and asked if they would be reimbursing phishing victims.

January 4, 2024

Gamma Strategies exploited for $6.2 million

(attribution)

The Gamma Strategies defi protocol suffered an exploit when an attacker targeted their vaults on several projects across the Arbitrum layer-2 network. The attacker successfully stole almost $6.2 million from these vaults by manipulating the price of some of the assets involved.

Gamma has contacted the hacker to try to negotiate a return of some of the assets, and also says they have engaged law enforcement. Although they have promised to try to repay some of the stolen assets, they are estimating between 25% and 40% recoveries for various categories of users.

"Post-Mortem & Remediation Plan", Gamma Strategies [archive]
"DeFi protocol Gamma Strategies suffers an estimated $3.4 million exploit", The Block [archive]

January 2, 2024

Radiant Capital lending protocol hacked for $4.5 million

(attribution)

Radiant Capital, a cross-chain lending protocol built on the Arbitrum layer-2 network, was hacked for 1,900 ETH (~$4.5 million). The exploit relied on a flaw in the underlying code, which was forked from Compound and Aave. The original code has a known rounding issue, which makes new projects vulnerable to attack shortly after they are deployed if they are not specifically configured to avoid the issue. In this case, the attacker had observed the contract being deployed and performed the exploit only six seconds after the project was activated.

Radiant Capital sent an on-chain message to the attacker, offering to negotiate a bounty.

Tweet thread by Radiant Capital [archive]
Tweet thread by PeckShield [archive]
On-chain message from Radiant Capital to the exploiter [archive]

January 2, 2024

Wallet security startup founder scammed out of $125,000

Bill Lou, the co-founder of a cryptocurrency wallet that claims to "revolutionize wallet security", was scammed out of 52 stETH (~$125,000) when he clicked a link promising an airdrop for a project. However, he had fallen for a phishing link that was prominently placed in Google search results, mimicking a real project but draining users' wallets when they authorized the transaction.

"I just got scammed out of $125k of stEth while trying to claim the $LFG airdrop. And I'm a fking founder of a wallet startup that's trying to improve wallet security..." wrote Lou on Twitter. "This is the first time I've been scammed. I always read about others but you never think it could happen to you..." he wrote.

If the founder of a wallet security project can't avoid scams in the crypto world, what hope do the rest of us have?

Tweet thread by Bill Lou [archive]

December 31, 2023

Orbit Bridge hacked for $81 million

(attribution)

The Orbit Bridge project, a cross-chain bridge for the Orbit Chain project, was exploited on December 31 for around $81 million. The attacker made off with around 26,742 ETH (~$64 million) and $18 million in the DAI stablecoin. Orbit Chain's total value locked plummeted from $152 million to $71 million as over half the funds were drained.

Orbit began sending the attacker on-chain messages, writing that "we will track you down and restore the damage you incurred to the ecosystem. And we will not stop." Orbit also wrote on Twitter that they were working with various law enforcement agencies.

"Orbit Chain Loses $81M in Cross-Chain Bridge Exploit", CoinDesk [archive]

December 28, 2023

Wallet gets phished for $4.4 million

Someone had a not so fun end to the year when they fell victim to a phishing attack and had around 275,700 LINK drained from their crypto wallet. Those tokens are priced at around $4.4 million.

The attack was perpetrated by the Pink Drainer group, which had recently compromised the Twitter account of Compound Finance to try to lure its more than 250,000 followers into authorizing the malicious drainer. It's not clear if that's how this wallet was drained, however, as Pink Drainer uses numerous strategies to attract victims.

Tweet by Scam Sniffer

December 28, 2023

UST and LUNA deemed securities in court

(attribution)

The federal judge overseeing the SEC v. Terraform Labs case has determined that Terra's UST stablecoin, LUNA token, and related tokens were securities. "There is no genuine dispute that UST, LUNA, wLUNA, and MIR are securities because they are investment contracts," wrote Judge Jed Rakoff.

This is a major decision in the crypto world, which recently celebrated a decision in the SEC v. Ripple case, which found that some sales of Ripple's XRP token did not constitute unregistered securities offerings.

The SEC has maintained a position that the majority of crypto asset offerings are securities offerings, which has been an unpopular opinion among those in the cryptocurrency industry — which broadly does not wish to be regulated by the SEC.

Memorandum & Opinion in SEC v. Terraform Labs [archive]

December 26, 2023

Levana Protocol loses over $1.1 million in slow motion

(attribution)

An attacker successfully manipulated an oracle to drain around 10% of the liquidity pool for the Levana Protocol, an Osmosis-based perpetual futures project. This amounted to $1.146 million.

The attack was unusual in that it lasted almost two weeks, going unnoticed because it was draining pools slowly enough that the Levana team assumed it was organic activity. However, when the network became congested, the attack suddenly became more profitable — and more noticeable.

"Levana exploit postmortem", Medium [archive]

December 26, 2023

Barry Silbert resigns from Grayscale board

(attribution)

New SEC filings have revealed that Digital Currency Group CEO Barry Silbert and president Mark Murphy have resigned from the board of Grayscale Investments, the organization behind the Grayscale Bitcoin Trust and a subsidiary of DCG.

Grayscale is in the midst of an application process with the SEC for approval to convert the trust into a spot bitcoin ETF. This has been an ongoing effort by Grayscale, and has been denied before.

DCG, meanwhile, is in the middle of financial difficulties and ongoing legal battles, including a lawsuit from the New York Attorney General alleging a $1 billion fraud by DCG and its Genesis subsidiary. The lawsuit from the NYAG also names Silbert personally.

"Barry Silbert and Mark Murphy resign from Grayscale's board", The Block [archive]

December 26, 2023

Telcoin exploited for $1.25 million

(attribution)

$TEL, the token associated with the Telcoin remittances project, plunged 40% as an exploiter was able to steal around $1.25 million from the project. The company later disclosed that the issue had to do with how the project had been implemented on the Polygon network. The app was taken offline as the company investigated the hack.

Telcoin later announced that they "plan[ned] to restore all wallets to their previous balances", though did not say whether or how they would be making up the $1.25 million deficit.

Telcoin had been audited by CertiK, though CertiK tweeted to say that "this contract was not in the scope of the audit conducted by CertiK".

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.