Posts

Showing posts with the label hack

Aave hacked via periphery contract — $56K stolen from ‘tip jar’

A ‘periphery’ contract of the decentralized finance (DeFi) sector’s biggest lending platform, Aave, was hacked for a total of $56,000 earlier today. Aave, which contains assets worth over $11 billion according to data from DeFiLlama, has made clear that the attack, which began, around 04:30 UTC placed no user funds at risk. Founder Stani Kulechov and governance delegate Marc Zeller both took to X (formerly Twitter) to reassure users. A periphery contract of @AAVE is hacked due to an arbitrary call/logic error. Most user funds are SAFU pic.twitter.com/WXa0w64n0c — Chaofan Shou (@shoucccc) August 28, 2024 Read more: Compound DAO asleep at the wheel as $25M governance ‘attack’ passes Fuzzland’s Chaofan Shou identified the cause of the hack, pointing to transactions on four networks: Ethereum, Aribtrum, Polygon, and Optimism. He estimated the total funds at risk to be around $70,000 . According to Analysis by security firm QuillAudits, the losses to attacks on the above net...

MEV bot to return $7.5M if Rho Markets admits to oracle error

Crypto assets worth $7.5 million were lost when Rho Markets, a decentralized finance (DeFi) lending platform on Ethereum L2 Scroll, was hacked. However, the operator of the MEV bot responsible is willing to return the funds — as long as Rho Markets admits to its mistakes. The suspicious activity was highlighted by an X (formerly Twitter) user, who noted that the platform was out of the stablecoins USDC and USDT. The user linked to the purported attacker’s address, which shows a gain of $7.5 million over the past hours. Scroll's Rho Markets exploited. USDC/USDT gone, so borrow ETH etc and wait. Think Oracle issue. Attacker address: https://t.co/CboWQND5ZQ pic.twitter.com/5hLWoltciI — CJ the "Doughnut" (@CJCJCJCJ_) July 19, 2024 Read more: Sifu’s UwU Lend reportedly Hack ed for $20M, Curve’s Egorov among affected Half an hour after the initial alert, Rho Markets announced ‘ unusual activity ‘ on the platform, which has been paused while the...

January’s 5 biggest crypto hacks earn criminals $39m

Nearly $50 million was stolen from web3 platforms in the year’s first month as crypto remains engaged in a cyber war with hackers and scammers.  Quantstamp, a defi security startup, reported five smart contract protocols with the highest losses from exploits and hackers in January. The five platforms lost $38.9 million to a basket of attack vectors deployed by bad actors. Four days into the year, Gamma Strategies was rocked by a flash loan attack. The code bug allowed exploiters to drain $6.1 million from Gamma’s public-facing vaults. Gamma shut off deposits to resolve the issue, effectively closing the loophole.  Although less than $10 million was stolen, roughly $500,000 denominated in Ether (ETH) was at risk during the incident. We have preliminarily reached the root cause of the recent exploit attack on our vaults. Out of abundance of caution, we shut off all deposits on our public-facing vaults — this effectively nullifies the attack any further because a deposit is re...

BSC suffers $73k Vyper attack following Curve Finance exploit

Image
The BNB Smart Chain (BSC) was hit by copycat attacks caused by a vulnerability in the Vyper programming language. It mirrors the Curve Finance defi protocol exploit . Blockchain security firm BlockSec revealed that as of July 30, approximately $73,000 worth of cryptocurrencies were stolen from the BSC through three separate exploit s. The latest development mirrored the ongoing exploit s on Ethereum’s Curve Finance, which had already seen losses surpassing $41 million. The sheet updated. Losses have already ~$41m!https://t.co/lCaS4uEPzm https://t.co/stQYNJFS7y pic.twitter.com/P7jG8NHnV4 — BlockSec (@BlockSecTeam) July 30, 2023 The vulnerability in question was found in Vyper versions 0.2.15, 0.2.16, and 0.3.0, which were used by various defi pools. The malfunctioning reentrancy lock in these versions enabled attackers to execute multiple functions simultaneously, leading to the possibility of draining all funds from affected contracts. Vyper, the programming language...