Thunder Terminal claims funds safe after $240K attack, hacker says otherwise
The on-chain trading platform confirmed a 3rd party compromise has led to funds being drained from 114 wallets but claims it has already fixed the issue. The hacker has a different take.
On-chain trading platform Thunder Terminal says user funds are now safe after thwarting a $240,000 exploit that compromised 114 wallets on its platform. The hacker, however, says it’s "all lies" and is demanding an additional ransom for user data.
https://cointelegraph.com/news/thunder-terminal-hack-exploit-wallet-compromise-hacker-demands-ransom
Topic: DeFi hacks [history] - page 2. (Read 19110 times)
https://invezz.com/news/2023/12/13/okx-dex-losses-370k-in-hack-users-assured-reimbursement/
"OKX Dex has faced a suspected hacking incident, resulting in losses exceeding $370,000.
OKX Dex swiftly responded to the breach by removing the compromised proxy address.
OKX also deactivated the affected contracts and reassured users of asset safety.
OKX‘s decentralized exchange and cross-chain bridge aggregator OKX Dex has fallen victim to a suspected hacking incident, resulting in losses exceeding $370,000. The breach raised alarms among users who noticed unauthorized transactions from wallets previously authorized on the platform.
The hacker is said to have exploited the vulnerability in OKX Dex’s authorization process as users exchange their crypto assets."
"OKX Dex has faced a suspected hacking incident, resulting in losses exceeding $370,000.
OKX Dex swiftly responded to the breach by removing the compromised proxy address.
OKX also deactivated the affected contracts and reassured users of asset safety.
OKX‘s decentralized exchange and cross-chain bridge aggregator OKX Dex has fallen victim to a suspected hacking incident, resulting in losses exceeding $370,000. The breach raised alarms among users who noticed unauthorized transactions from wallets previously authorized on the platform.
The hacker is said to have exploited the vulnerability in OKX Dex’s authorization process as users exchange their crypto assets."
https://beincrypto.com/florence-finance-loses-1-45-million-hackers/
"Scammers have stolen $1.45 million in USDC from the real-world asset lending project, Florence Finance, via a phishing attack.
The Florence Finance attack involved address poisoning, a common phishing technique where a fraudulent, similar-looking address is used.
Co-founder and CEO of Cyvers, Deddy Lavid, has emphasized the need for heightened security measures in the digital finance sector."
"Scammers have stolen $1.45 million in USDC from the real-world asset lending project, Florence Finance, via a phishing attack.
The Florence Finance attack involved address poisoning, a common phishing technique where a fraudulent, similar-looking address is used.
Co-founder and CEO of Cyvers, Deddy Lavid, has emphasized the need for heightened security measures in the digital finance sector."
https://twitter.com/KyberNetwork/status/1728800315955437743
"The KyberSwap team has been in contact with the owners of the frontrun bots that extracted about $5.7M* worth of funds from KyberSwap pools on Polygon and Avalanche during the exploit.
We have negotiated with the owners of the frontrun bots to return 90% of the users’ funds taken by them to: 0x8180a5CA4E3B94045e05A9313777955f7518D757,
in return for a 10% bounty as described in this on-chain message: https://polygonscan.com/tx/0x8a0880f1662e39fa838e89fa751669e4a1eee5c15586dc447453274f7b8ce746
.."
"The KyberSwap team has been in contact with the owners of the frontrun bots that extracted about $5.7M* worth of funds from KyberSwap pools on Polygon and Avalanche during the exploit.
We have negotiated with the owners of the frontrun bots to return 90% of the users’ funds taken by them to: 0x8180a5CA4E3B94045e05A9313777955f7518D757,
in return for a 10% bounty as described in this on-chain message: https://polygonscan.com/tx/0x8a0880f1662e39fa838e89fa751669e4a1eee5c15586dc447453274f7b8ce746
.."
What do you think is the reason why this case always happens every year? If you look at history, there will always be things like this.
Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
Now the question is whether it is wise not to trust an exchange with all your coins. Indeed, this is an easy target for bandits and no matter how strong the security system created by the exchange, it will still be searchable and this year 2023 the cryptocurrency market is very unstable.
What do you think is the reason why this case always happens every year? If you look at history, there will always be things like this.
Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
Most of them are hacked by closed friends and also careless or improper security caused by the developer. When a project is launched the developer should put the security of the site in his mind first and always and if it is not enough they should buy more security space for the site so that when a hacker visit the site it would bounced back but whereby you only develop the site and dump it like that without any extra security measures to prevent and protect the site then hackers will be very happy to penetrate. Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
In sometimes, co-workers, or a mistake of the owner of the DeFi caused the hack. And this has happened to me before. I mistakenly send a code that was sent to me in Facebook and it used to hacked my Facebook account, they are some emails DeFi received and they were trying to quote those messages by replying them and a code which was secretly sent was forwarded to them and the site was hacked.
What do you think is the reason why this case always happens every year? If you look at history, there will always be things like this.
Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
Is it that easy to hack or is the security of each project different, or is this a game of the people closest to it, because they are the ones who can reach it the easiest, and there are many other possibilities.
https://www.msn.com/en-us/news/technology/infstones-to-implement-key-rotations-following-vulnerability-disclosure-in-lido-protocol/ar-AA1kqfJR
InfStones to Implement Key Rotations Following Vulnerability Disclosure in Lido Protocol
"Addressing the Tailon library vulnerability
The vulnerability, which was discovered in the open-source Tailon library, posed a potential risk to the Lido Finance protocol. Lido Finance, known for being the largest liquid staking protocol on Ethereum, oversees a substantial amount of ether, amounting to 9.23 million with a market value exceeding $19 billion. The protocol allows users to deposit ETH and participate in network staking through validator nodes. These nodes issue a derivative token to users, representing their staked deposit. A network of contributors, known as operators, is responsible for running these ETH validator nodes."
InfStones to Implement Key Rotations Following Vulnerability Disclosure in Lido Protocol
"Addressing the Tailon library vulnerability
The vulnerability, which was discovered in the open-source Tailon library, posed a potential risk to the Lido Finance protocol. Lido Finance, known for being the largest liquid staking protocol on Ethereum, oversees a substantial amount of ether, amounting to 9.23 million with a market value exceeding $19 billion. The protocol allows users to deposit ETH and participate in network staking through validator nodes. These nodes issue a derivative token to users, representing their staked deposit. A network of contributors, known as operators, is responsible for running these ETH validator nodes."
Data shared by blockchain security platform PeckShield shows that more than $86.6 million in digital assets were transferred from the HECO Chain bridge to suspicious addresses. The security firm suggests that the bridge is compromised and an exploit is ongoing.
In response to the incident, Tron founder Justin Sun announced that HTX will fully compensate users for any losses incurred in the hack. The company has also temporarily suspended deposits and withdrawals as they investigate the incident. The executive said services will resume after the investigation is completed.
https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost
HTX and Heco Cross-Chain Bridge Undergo Hacker Attack.
https://twitter.com/justinsuntron/status/1727304656622326180?
In response to the incident, Tron founder Justin Sun announced that HTX will fully compensate users for any losses incurred in the hack. The company has also temporarily suspended deposits and withdrawals as they investigate the incident. The executive said services will resume after the investigation is completed.
https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost
HTX and Heco Cross-Chain Bridge Undergo Hacker Attack.
https://twitter.com/justinsuntron/status/1727304656622326180?
https://cryptonews.com/news/kyberswap-hacked-for-48-million-hackers-suggest-negotiations.htm
"KyberSwap Hacked for $48 Million, Hackers Suggest Negotiations
KyberSwap, a decentralized exchange, has been compromised in a hack resulting in the theft of $48 million, prompting the platform to advise users to withdraw their funds while the attackers hint at entering negotiations.
On-chain data indicates that the hack on KyberSwap resulted in significant losses of $48 million across several blockchain networks, including 20 million from Arbitrum, $15 million from Optimism and $7 million from Ethereum.
The stolen funds were primarily deposited in Ethereum (ETH), Wrapped Ethereum (wETH), and USD Coin (USDC). The analysis of the incident indicates a direct attack on the exchange’s liquidity pools instead of a vulnerability in the platform’s code."
"KyberSwap Hacked for $48 Million, Hackers Suggest Negotiations
KyberSwap, a decentralized exchange, has been compromised in a hack resulting in the theft of $48 million, prompting the platform to advise users to withdraw their funds while the attackers hint at entering negotiations.
On-chain data indicates that the hack on KyberSwap resulted in significant losses of $48 million across several blockchain networks, including 20 million from Arbitrum, $15 million from Optimism and $7 million from Ethereum.
The stolen funds were primarily deposited in Ethereum (ETH), Wrapped Ethereum (wETH), and USD Coin (USDC). The analysis of the incident indicates a direct attack on the exchange’s liquidity pools instead of a vulnerability in the platform’s code."
Raft Suffers $3.3M Exploit That Drove Down Stablecoin 50%, but Hacker Likely Lost Money on Attack
https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack/
"Decentralized finance (DeFi) platform Raft lost some $3.3 million in ether (ETH) after being hacked Friday afternoon – but the attacker may have suffered a loss on the heist.
On-chain data shows that the attacker drained 1,577 ETH from Raft, then sent 1,570 ETH to a burn address – destroying most of the stolen assets and leaving only 7 ETH for themselves. The hacker's address received 18 ETH via crypto mixer service Tornado Cash before the attack, blockchain data on Arkham shows, likely to fund transactions.
After executing the transfers and paying the blockchain fees, the exploiter's crypto wallet was left with only 14 ETH, fewer funds than the initial 18 ETH.
This means that they face a 4 ETH loss on the whole maneuver."
TrustPad Attack Post-Mortem
https://trustpad.medium.com/trustpad-attack-post-mortem-c09ccc01e0ef
exploit to one of TrustPad’s staking contracts
https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack/
"Decentralized finance (DeFi) platform Raft lost some $3.3 million in ether (ETH) after being hacked Friday afternoon – but the attacker may have suffered a loss on the heist.
On-chain data shows that the attacker drained 1,577 ETH from Raft, then sent 1,570 ETH to a burn address – destroying most of the stolen assets and leaving only 7 ETH for themselves. The hacker's address received 18 ETH via crypto mixer service Tornado Cash before the attack, blockchain data on Arkham shows, likely to fund transactions.
After executing the transfers and paying the blockchain fees, the exploiter's crypto wallet was left with only 14 ETH, fewer funds than the initial 18 ETH.
This means that they face a 4 ETH loss on the whole maneuver."
TrustPad Attack Post-Mortem
https://trustpad.medium.com/trustpad-attack-post-mortem-c09ccc01e0ef
exploit to one of TrustPad’s staking contracts
https://twitter.com/AstridFinance/status/1718236380009230406
"Unfortunately our smart contract was exploited due to a fix recommended by our auditor.
We have paused the contract.
We have taken a snapshot of all holders and will offer full refund and make everyone whole. Please wait as our team work out the refund process.
We truly apologize for what happened and will make sure everyone is refunded accordingly "
Damage approximately 245 000 dollars AstridFinance
https://twitter.com/AstridFinance/status/1718563845323866383
"Hacker has decided to return our funds (minus 20% as per the bounty), as such we consider this as settled amicably."
https://etherscan.io/tx/0x27cbd5f2f12067bcc9be3bafa9140b849ee1ee68ae5329c2a4ba789685111ad7
"Unfortunately our smart contract was exploited due to a fix recommended by our auditor.
We have paused the contract.
We have taken a snapshot of all holders and will offer full refund and make everyone whole. Please wait as our team work out the refund process.
We truly apologize for what happened and will make sure everyone is refunded accordingly "
Damage approximately 245 000 dollars AstridFinance
https://twitter.com/AstridFinance/status/1718563845323866383
"Hacker has decided to return our funds (minus 20% as per the bounty), as such we consider this as settled amicably."
https://etherscan.io/tx/0x27cbd5f2f12067bcc9be3bafa9140b849ee1ee68ae5329c2a4ba789685111ad7
FixedFloat blocked coins from hacker group Lazarus
Thanks to the coordinated efforts of our team over the past three days, an attempt to launder stolen funds associated with the hacker group Lazarus from the DPRK has been successfully thwarted.✔️
The total amount of funds subject to blocking amounted to about two million dollars. 💵
We will continue to work towards enhancing the security and reliability of our services. 🚀
Source:
https://twitter.com/FixedFloat/status/1720448805303161327
Thanks to the coordinated efforts of our team over the past three days, an attempt to launder stolen funds associated with the hacker group Lazarus from the DPRK has been successfully thwarted.✔️
The total amount of funds subject to blocking amounted to about two million dollars. 💵
We will continue to work towards enhancing the security and reliability of our services. 🚀
Source:
https://twitter.com/FixedFloat/status/1720448805303161327
https://cointelegraph.com/news/onyx-protocol-exploiter-siphon-2-1-m-loot-tornado-cash
"Decentralized peer-to-peer lending platform Onyx Protocol lost roughly $2.1 million in an exploit of a market with no liquidity that was deployed on Oct. 27.
The Onyx Protocol hacker exploited a known bug, a rounding issue behind the popular CompoundV2 fork, explained blockchain investigator PeckShield soon after alerting about the hack that went unnoticed by the protocol."
"Decentralized peer-to-peer lending platform Onyx Protocol lost roughly $2.1 million in an exploit of a market with no liquidity that was deployed on Oct. 27.
The Onyx Protocol hacker exploited a known bug, a rounding issue behind the popular CompoundV2 fork, explained blockchain investigator PeckShield soon after alerting about the hack that went unnoticed by the protocol."
https://twitter.com/DeDotFiSecurity/status/1717327912410456355
"🚨 ~$743,000 Exit Scam Alert 🚨
Fake $LINEA token has been rug pulled earlier today, previously flagged with a Rug Pull High Risk issue
@DeDotFi
Scanner also identified token as a Honeypot
All the stolen funds were transferred to Tornado Cash"
"🚨 ~$743,000 Exit Scam Alert 🚨
Fake $LINEA token has been rug pulled earlier today, previously flagged with a Rug Pull High Risk issue
@DeDotFi
Scanner also identified token as a Honeypot
All the stolen funds were transferred to Tornado Cash"
How Hackers Attacked Telegram Trading Bot to Steal $500,000
Hackers exploited a vulnerability in the Maestro Router 2 smart contract, stealing 280 ETH ($500,000) from Telegram trading bot Maestro.
The Maestro attack resulted in a 30% drop in JOE tokens' price due to lack of liquidity. The stolen ETH was transferred to Railgun, a crypto privacy tool.
Despite the hack, Maestro refunded all affected users by purchasing and returning the lost tokens. The bot has earned over $20 million in fees in 2
https://beincrypto.com/maestro-refunds-after-attack/
Hackers exploited a vulnerability in the Maestro Router 2 smart contract, stealing 280 ETH ($500,000) from Telegram trading bot Maestro.
The Maestro attack resulted in a 30% drop in JOE tokens' price due to lack of liquidity. The stolen ETH was transferred to Railgun, a crypto privacy tool.
Despite the hack, Maestro refunded all affected users by purchasing and returning the lost tokens. The bot has earned over $20 million in fees in 2
https://beincrypto.com/maestro-refunds-after-attack/
https://cointelegraph.com/news/stars-arena-recovers-stolen-funds-after-offering-bounty-exploit
Stars Arena recovers 90% of stolen funds after offering $257K bounty
"The exploiter of the Web3 social media platform agreed to keep a 10% bounty in exchange for returning the remainder of the stolen funds.
Web3 social media platform Stars Arena said it has recovered nearly all of the crypto stolen from an Oct. 7 exploit, minus a 10% bounty to the person responsible.
In an Oct. 11 X (Twitter) post, Stars Arena said around 90% of the 266,000 Avalanche exploited, at the time worth around $3 million, was returned after reaching an agreement to give a 27,610-AVAX bounty worth nearly $257,000 to the exploiter.
The bounty also included compensation for 1,000 AVAX worth over $9,000 seemingly lost by the exploiter in a bridge."
Stars Arena recovers 90% of stolen funds after offering $257K bounty
"The exploiter of the Web3 social media platform agreed to keep a 10% bounty in exchange for returning the remainder of the stolen funds.
Web3 social media platform Stars Arena said it has recovered nearly all of the crypto stolen from an Oct. 7 exploit, minus a 10% bounty to the person responsible.
In an Oct. 11 X (Twitter) post, Stars Arena said around 90% of the 266,000 Avalanche exploited, at the time worth around $3 million, was returned after reaching an agreement to give a 27,610-AVAX bounty worth nearly $257,000 to the exploiter.
The bounty also included compensation for 1,000 AVAX worth over $9,000 seemingly lost by the exploiter in a bridge."
MEV bot earned $1.5 million thanks to a $4 attack
https://wixi.exchange/en/news/3479042.html
https://wixi.exchange/en/news/3479042.html
https://cryptonews.com/news/defi-protocol-platypus-finance-hacked-for-over-2-million-avalanche-heres-what-happened.htm
DeFi Protocol Platypus Finance Hacked for Over $2 Million on Avalanche
"Decentralized finance (DeFi) protocol Platypus Finance has fallen victim to a security breach resulting in the loss of over $2 million.
In a recent blog post on X (formerly Twitter), security firm PeckShield noted that the Avalanche-based project has been exploited.
Following the alert, Platypus Finance confirmed that there had been suspicious activities in the protocol, prompting the project to take "the proactive measure of temporarily suspending all pools.""
DeFi Protocol Platypus Finance Hacked for Over $2 Million on Avalanche
"Decentralized finance (DeFi) protocol Platypus Finance has fallen victim to a security breach resulting in the loss of over $2 million.
In a recent blog post on X (formerly Twitter), security firm PeckShield noted that the Avalanche-based project has been exploited.
Following the alert, Platypus Finance confirmed that there had been suspicious activities in the protocol, prompting the project to take "the proactive measure of temporarily suspending all pools.""
Star arena ,a best social platform experience defi hacking. The hackers able to access their contract and exploit a reentrancy vulnerability within the code which allowed them to inflate the share's value, reaching approximately $274K per share. Hackers steal almost 2.9 million worth of AVAX token. This hacks happened in October 2023.
Defi hacking is increased so much in 2023 and most of hacker target contract address and this hacks also is part of it. Need lot of protection and audit check everytime.
SOURCE
https://www.halborn.com/blog/post/explained-the-stars-arena-hack-october-2023
Defi hacking is increased so much in 2023 and most of hacker target contract address and this hacks also is part of it. Need lot of protection and audit check everytime.
SOURCE
https://www.halborn.com/blog/post/explained-the-stars-arena-hack-october-2023
Jump to: