1916 hack event(s)
Description of the event: Recently, Iron Finance, a stablecoin mortgage platform based on Binance Chain, was attacked. Two vFarm liquidity pools (50% IRON—50% SIL pool; 50% IRON—50% BUSD pool) lost a total of 170,000 US dollars. Later, the official publication of the incident stated that: 1. The cause of the attack was due to the upgrade of the cloud service (FaaS) and the change in the reward rate integer, but the official team was not aware of the problem. Later, an attacker made a profit of 170,000 U.S. dollars by selling all the local token SIL rewards. 2. The Iron Finance smart contract has no loopholes. 3. vFarms will be restarted on March 18th, and SIL tokens will be restarted to sIRON. 4. Users should not sell or exchange IRON tokens for the time being. When the new pool is restarted, the full amount of BUSD can be redeemed. The Iron Finance agreement was launched on the BSC in early March. The IRON stablecoin is pegged to the U.S. dollar, partly backed by collateral such as BUSD and USDT, and partly backed by the SIL algorithm.
Amount of loss: $ 170,000 Attack method: Affected by Cloud Service Upgrade
Description of the event: A cross-chain stablecoin (TSD) on ETH and BSC stated that malicious attackers used TSD DAO to mint 11.8 billion TSD tokens in their accounts and sold them all on Pancakeswap. The specific process is that True Seigniorage Dollar stated that the developer account only has 9% of the DAO, and the malicious attacker has gradually controlled 33% of the DAO with the accumulation of low prices, and then proposed an implementation plan and voted in favor. In the implementation, the attacker added code to Mint and minted 11.8 billion TSDs for himself.
Amount of loss: $ 7,095,340 Attack method: Contract Vulnerability
Description of the event: Many DeFi protocol websites on BSC (Binance Smart Chain) were attacked by DNS, including Cream Finance and BSC header DEX PancakeSwap. The attacker requested users to submit personal private keys or mnemonics through the website. The relevant project team has passed Twitter Remind users not to visit the website and do not submit information such as private keys. Later PancakeSwap and Cream Finance both stated that they had regained access to DNS.
Amount of loss: - Attack method: DNS attack
Description of the event: The community token platform TryRoll was suspected of being attacked, and the tokens issued based on it were sold in a large amount on Uniswap. Among them, WHALE lost 1,362 ETH, FWB lost 797 ETH, KARMA lost 155 ETH, JULIEN lost 115 ETH, hackers made a total of 2998 ETH, and 700 ETH was deposited in the mixed currency platform Tornado.Cash. In addition, Roll announced that it has raised $500,000 in funding for creators affected by this.
Amount of loss: 2,998 ETH Attack method: Private Key Leakage
Description of the event: The oracle project HSO on the Huobi Eco-Chain HECO carried out IDO and ran away with 30,000 HT. The website and TELEGRAM could not be opened. Later, under the full promotion of HECO core code contribution team Star Lab, HECO technical community and HECO White Hat Security Alliance, 24823 HTs have been recovered.
Amount of loss: 5,177 HT Attack method: Rug Pull
Description of the event: The decentralized exchange DODO announced the progress of the attack on some fund pools. The main reason for this attack was that the crowdfunding fund pool contract initialization function did not prevent repeated calls, which led to hackers reinitializing the contract and completing the attack through lightning loans. In this incident, there were three participants, a hacker and two trading robots. A total of approximately US$3.8 million worth of funds were attacked. At present, the owners of the two trading robots have returned approximately US$3.1 million in tokens. In addition, funds worth approximately US$200,000 are frozen on the centralized exchange, and the remaining value of approximately US$500,000 is borne by the DODO team, and all funds will be returned within 24 hours. At the same time, security companies Chengdu Lian'an and SlowMist Technology have been invited to conduct a new round of code audits, and it is expected that the crowdfunding pool building function will be restored within a week.
Amount of loss: $ 500,000 Attack method: Init function unlimited
Description of the event: Curve Finance tweeted that a vulnerability was found in the Pool Factory v1 version of the fund pool, and it is recommended that v1 users use crv.finance to withdraw funds immediately. Curve.fi and Pool Factory v2 fund pools do not respond. But it only affects the v1 pool, and hackers cannot use it to steal user funds.
Amount of loss: - Attack method: Contract Vulnerability
Description of the event: CNA, one of the largest insurance companies in the United States, paid a ransom of US$40 million (approximately 257 million yuan) after being attacked by ransomware in March to regain control of its network. The company has confirmed that an organization named Phoenix is the perpetrator of this attack.
Amount of loss: $ 40,000,000 Attack method: Ransomware
Description of the event: According to the official community information of Meerkat Finance, its vault contract was hacked, and the hacker used the loophole to steal all the funds in the vault. According to reports, the BSC project Meerkat Finance is suspected of running away and swept away about 31 million US dollars, of which 14 million BUSD and the other 73,000 BNB. MKAT claims to have been hacked to steal all resources.
Amount of loss: $ 31,000,000 Attack method: Rug Pull
Description of the event: Tether officially tweeted that forged documents allegedly "between Tether personnel and representatives of Deltec Bank & Trust and other institutions" are circulating online. In addition, Tether officially received a ransom request for sending 500 BTC to bc1qa9f60pved3w3w0p7snpxlnh5t4uj95vxn797a7 today. The sender stated that unless they receive Bitcoin before tomorrow, they will leak documents to the public in order to "destroy the Bitcoin ecosystem." Tether said it will not pay the ransom. And remind customers, employees, and the encryption community to stay vigilant and ensure operational safety. Tether stated that it has reported falsified communications and related ransom demands to law enforcement.
Amount of loss: - Attack method: Ransomware
Description of the event: The game ecosystem platform SeascapeNetwork stated that the private key of an early investor was stolen after the token was released today, which led to hackers obtaining 18,750 CWS in the investor's wallet. According to Etherscan data verification, this address has changed all CWS to ETH, and then recharged it to the Ethereum mixing platform Tornado.Cash several times, which is close to 330 ETH, which is equivalent to USD 500,000.
Amount of loss: $ 500,000 Attack method: Private Key Leakage
Description of the event: The 70 GB data of Gab, a social networking platform that supports Bitcoin, was hacked. Gab has handed over the hacked data to the reporting website Distributed Denial of Secrets. Emma Best, founder of Distributed Denial of Secrets, said that the hacked data included public posts, personal information and passwords, and private account posts and messages.
Amount of loss: - Attack method: Information Leakage
Description of the event: The agent of the DeFi platform Furucombo was attacked and the amount stolen amounted to more than 15 million U.S. dollars. The DeFi aggregation platform Furucombo officially released a tweet, saying: "The root cause has been found and the vulnerability has been patched. The funds are now safe. We are investigating the stolen funds and organizing follow-up actions. The follow-up will continue to be updated."Later, Furucombo stated that it would issue 5 million iouCOMBO tokens to affected users
Amount of loss: $ 15,000,000 Attack method: Contract Vulnerability
Description of the event: DeFi Insurance Agreement The Armor team claimed that some team members were scammed by OTC and were defrauded of 1.2 million ARMOR tokens. The scammers have already dumped all tokens for a profit of 600 ETH (approximately US$850,000). The Armor team disclosed that the scammers pretended to be strategic investors on social media, falsely claiming to purchase tokens from the team through OTC, defrauded 1.2 million ARMOR tokens in OTC transactions, and then sold them. According to the Armor team, "No hacking, the project is still safe."
Amount of loss: $ 850,000 Attack method: Scam
Description of the event: The DAI pool of Yeld.finance, the DeFi revenue aggregator, was attacked by a lightning loan, resulting in a loss of 160,000 DAI, involving more than 10 users. Tether, TrueUSD and USDC were not affected. According to reports, Yeld’s problem is consistent with the previous Yearn.Finance DAI pool vulnerability problem. The official also stated that the affected users will be repaid with tokens, which will be rewarded with income from the DAI pool to make up for some of their losses. Later, Yeld.finance officially stated that the 160,000 DAI caused by the lightning loan attack has been returned. This event is suspected to be the work of a white hat, and the official will further update the details.
Amount of loss: $ 160,000 DAI Attack method: Flash loan attack
Description of the event: A serious loophole has been discovered in the Primitive Finance smart contract on the Ethereum chain options agreement. Since the contract cannot be upgraded or suspended, the official chose to hack the smart contract to protect user funds. The hacked funds are safe. All hacked funds will be returned to their owners.
Amount of loss: - Attack method: Contract Vulnerability
Description of the event: According to Stuff.co.nz, hackers took approximately 62,000 New Zealand dollars (45,000 USD) worth of cryptocurrency from the troubled exchange. The investigation revealed that the hacker accessed a dormant wallet that belongs to the US-based blockchain company Stakenet and is controlled by Grant Thornton, the liquidator of Cryptopia. According to the survey results, the dormant wallet holds XSN worth approximately US$1.96 million, which is the native token of Stakenet.
Amount of loss: $ 45,000 Attack method: Unknown
Description of the event: UL LLC (commonly known as Underwriters Laboratories) suffered a ransomware attack that encrypted its server and caused the server to shut down the system when it recovered. To prevent the attack from spreading further, the company shut down the system so that certain employees could not perform their work. According to sources familiar with the attack, UL decided not to pay the ransom, but to restore from backup.
Amount of loss: - Attack method: Ransomware
Description of the event: F2Pool was attacked by DDos, and some addresses experienced short-term failures, which have been restored.
Amount of loss: - Attack method: DDoS Attack
Description of the event: According to CryptoPotato, the ransomware group DoppelPaymer launched another attack, this time leaking sensitive data of KMA, the North American branch of automaker Kia Motors. Criminals demand Bitcoin to pay the ransom, and the total ransom may be as high as 600 Bitcoins (worth more than 30 million U.S. dollars). KMA stated that the company has experienced “IT outages involving internal, reseller, and customer-facing systems” and stated that it is working to resolve these issues. The ransom note left by the DoppelPaymer ransomware group stated that they had broken into KMA's system.
Amount of loss: - Attack method: Ransomware