78 hack event(s)
Description of the event: The founder of one of Russia's largest cryptocurrency scams has been in jail for allegedly defrauding US$100 million from its investors. Finiko was established in Kazan in 2019 and pretended to be a legitimate BTC investment company. In December 2020, Finiko released its native digital currency FNK. According to local reports, the founders will take BTC from investors and reward them with FNK tokens.
Amount of loss: $ 100,000,000 Attack method: Scam
Description of the event: Solana Ecological Lending Agreement Solend tweeted that the agreement was hacked at 20:40 on August 19th, Beijing time. The attacker cracked the insecure identity check in the UpdateReserveConfig function, allowing it to liquidate all accounts. In addition, the hacker also set the APY of borrowed funds to 250%. During this period, the funds of 5 users were mistakenly liquidated, and the liquidator is currently refunding the losses of these 5 users totaling USD 16,000. Solend said that this attack did not result in the theft of funds, and that the scale of the bug bounty will be increased and a better monitoring and alarm system will be established.
Amount of loss: $ 16,000 Attack method: The insecure identity check in the UpdateReserveConfig function is cracked
Description of the event: The NEAR ecological decentralized exchange Ref.Finance team tweeted that at around 2 pm UTC on August 14th, the Ref team noticed the abnormal behavior of the REF-NEAR trading pair, and then discovered that the patch of the recently deployed contract An error, which has been exploited by multiple users, affected approximately 1 million REFs and 580,000 NEARs. At present, the Ref team has suspended the contract for 48 hours to prevent further attacks and coordinated with the exchange to block the corresponding account. The user does not need to take any action, and Ref will fully compensate any permanently lost funds. At the same time, the Ref team expressed the hope that the corresponding account will return the funds. If it is not returned within 48 hours, it will adopt operations such as forking the token contract and issuing new tokens to the corresponding project party.
Amount of loss: $ 3,202,539 Attack method: Fix bug
Description of the event: According to Reuters, a judge of the London High Court approved the request of the artificial intelligence company Fetch.ai, ordering Binance to track down hackers who stole $2.6 million in assets in Fetch.ai's Binance account and freeze the assets stolen by the hackers. A Binance spokesperson stated that in order to protect the safety of users' property, Binance will periodically freeze accounts that are deemed to have suspicious activities. Currently, Binance is helping Fetch.ai restore assets.
Amount of loss: $ 2,600,000 Attack method: Unknown
Description of the event: BachOnChain, a core member of Duet Protocol, a multi-chain synthetic asset protocol, tweeted that the Duet Protocol pioneer network Zerogoki experienced an oracle attack a few hours ago, and the wrong price led to unrecognized transactions. BachOnChain said that the oracle has been suspended, zUSD has experienced certain fluctuations, and it is expected that the price will resume in market trading and arbitrage after a period of time.
Amount of loss: $ 670,000 Attack method: Oracle attack
Description of the event: Some Twitter users reported receiving a token airdrop named VERA (The Vera) project, but the tokens in the wallet were stolen after the official website was authorized. After inquiry, it was found that the project was suspected to be an airdrop trap. The specific method was to airdrop 80,000 tokens (worth approximately US$9,600) through a single address to attract user attention, and set up a mechanism to allow users to fail transactions on Pancakeswap, which in turn led users to the official website to cheat. Authorize the implementation of theft.
Amount of loss: - Attack method: Scam
Description of the event: A crook named "cryptopunksbot" was published on CryptoPunk's Discord server, providing NFT investors with the opportunity to win ten elusive NFT avatars. Stazie, the co-founder of the NFT game project Hedgie, accepted the false offer poster, but this move eventually cost him 16 CryptoPunks, which may be worth at least $1 million. Stazie inadvertently sent the wallet seed phrase to the scammer, resulting in the loss of some ETH. The scammer sold 5 CryptoPunks for 149 ETH ($385,000).
Amount of loss: $ 1,000,000 Attack method: Phishing attack
Description of the event: Mobile phone operator T-Mobile filed a lawsuit for failing to prevent the SIM exchange scam, which cost a customer $55,000 in Bitcoin. The plaintiff Richard Harris accused T-Mobile of improper behavior, including failing to adequately protect customer information, hiring appropriate support personnel, and violating federal and state laws that caused him to lose 1.63 bitcoins.
Amount of loss: $ 55,000 Attack method: SIM exchange scam
Description of the event: The digital collectibles market platform Bondly Finance released an analysis report on the previous attack. Bondly Finance believes that the attacker obtained access to the password account belonging to Bondly CEO Brandon Smith through a carefully planned strategy. The password account contains the assistance of his hardware wallet. Recalling the phrase to restore the phrase, after copying, allowed the attacker to access the BONDLY smart contract, and the company wallet that was also leaked, resulting in the minting of 373 million BONDLY tokens.
Amount of loss: 373,000,000 BONDLY Attack method: Control access to password accounts
Description of the event: According to official news, Polkadot's ecological oracle and prediction protocol OptionRoom stated that it was affected by the "cross-chain asset bridge ChainSwap attack", and many projects including OptionRoom were affected by the hacker attack. Hackers can obtain 2.3 million ROOM tokens on Ethereum and 10 million ROOM tokens on BSC. OptionRoom noticed the hacking before the hackers sold any tokens and decided to remove liquidity from Uniswap and Pancakeswap to protect token holders and liquidity providers from being sold to the liquidity pool by hackers. By selling the deployer's tokens to the Uniswap pool, OptionRoom was able to recover $342,117. In this way, OptionRoom successfully extracted liquidity on behalf of the liquidity provider of the project. The recovered amount will be allocated according to the share of the liquidity provider.
Amount of loss: $ 647,467 Attack method: Contract vulnerability
Description of the event: According to official sources, DAFI Protocol, an on-chain incentive protocol, stated that DAFI worth 200,000 US dollars was sold due to the “cross-chain asset bridge ChainSwap attack”. DAFI Protocol requests the community to withdraw liquidity from Uniswap and LP plans until further notice. DAFI Protocol added that the DAFI token contract and Super Staking are safe.
Amount of loss: $ 200,000 Attack method: Contract vulnerability
Description of the event: According to official sources, Dora Factory, a multi-chain service infrastructure based on Polkadot, suffered a contract vulnerability in the cross-chain asset bridge ChainSwap. The 7,872 DORA locked in the ChainSwap cross-chain bridge contract was taken out by hackers and sold through Uniswap.
Amount of loss: $ 42,373 Attack method: Contract vulnerabilities
Description of the event: Circle Internet Financial, the issuer of the US dollar stable currency USDC, reported in a regulatory filing with the US Securities and Exchange Commission (SEC) that Circle Internet Financial lost US$2 million in email fraud last month. Circle stated that the email fraud incident did not affect customer funds and accounts, Circle's information system is still safe, and the US$2 million is the company's own funds.
Amount of loss: $ 2,000,000 Attack method: Scam
Description of the event: Lookout Threat Lab security researchers exposed more than 170 Android applications, and the number of deceived users exceeded 93,000. Among them, 25 applications managed to evade the Google Play Store detection and successfully launched, but this is mainly because they do not involve any malicious operations, and may even be purely to fool users. Lookout security researchers pointed out that these counterfeit applications belong to the BitScam and CouldScam series respectively, claiming to provide cloud-based cryptocurrency mining services that can aggregate the computing power of users' mobile devices and share mining revenue. These apps are not free, and various additional payment excuses such as subscriptions and upgrades will be made. Prices range from 12.99 to 259.99 US dollars, and cryptocurrencies such as BTC or ETH are accepted as payment methods. LookoutThreatLab estimates that these malware creators defrauded 300,000 U.S. dollars through illegal sales and 50,000 U.S. dollars in cryptocurrency through fake payments and upgrade services.
Amount of loss: $ 350,000 Attack method: Scam
Description of the event: Cobra, the anonymous creator and principal of Bitcoin.org, tweeted that the Bitcoin.org website is being subjected to an "absolutely large-scale" distributed denial of service (DDoS) attack, as well as a Bitcoin ransom demand. Currently Bitcoin.org is accessible.
Amount of loss: - Attack method: DDos attack
Description of the event: RAI Finance, a cross-chain transaction protocol based on the Polkadot blockchain, issued a post stating that due to the vulnerability of the ChainSwap smart contract, the RAI access and payment permission addresses connected to it were also hacked and stolen. The total amount of stolen RAI in the account reached 2.9 million. On July 5, Rai Finance tweeted that after investigation by the team, hackers had returned 2.2 million RAIs to ChainSwap Deployer. The total loss caused by this incident was reduced to 670,000 RAI.
Amount of loss: $ 414,013 Attack method: RAI access and payment authority addresses were attacked
Description of the event: The cross-chain asset bridge Chainswap announced the details of the hacking incident today, saying that at 04:30 AM UTC on July 2nd, they noticed an abnormality on the cross-chain bridge. Some users reported that their tokens were actively removed from wallets interacting with ChainSwap. After it was taken out, the ChainSwap team immediately froze the cross-chain bridge, shut down all nodes, and deployed the fix within 30 minutes. The team of the affected project received an alert. According to the announcement, the stolen assets include 32237576.17 TSHP, 80052.82027 CORRA, 643405.7157 BLANK, 2922720 RAI, 19392.27712 ROOM, 4820309.98 DEXT, 210,108.22 UMB, 55476328.8 FAIR. Chainswap stated that after negotiating with hackers, it has recovered some of the CORRA and RAI tokens, and the total loss is estimated to be 800,000 US dollars. At present, a small amount of affected tokens have been repurchased from the market and returned to the contract wallet. The rest will be fully paid by Chainswap Vault Compensation. In addition, Chainswap will also issue compensation to affected users.
Amount of loss: $ 800,000 Attack method: Technical vulnerabilities
Description of the event: According to Calcalist, the cryptocurrency company StakeHound has filed a lawsuit against the institutional security company Fireblocks, claiming that ETH worth 245.5 million Israeli new shekels (approximately US$75 million) was lost due to Fireblocks’ mistakes. StakeHound stated that as Fireblocks deleted the key for no reason without backing up the key, 38,178 ETH were lost.
Amount of loss: $ 75,000,000 Attack method: Delete key
Description of the event: On May 7, 2021, Colonial Pipeline, the nation's largest oil and gas pipeline operator, was targeted by a ransomware attack. The ransomware attack involved national critical infrastructure, which caused global shock and widespread concern. Was blackmailed to pay 5 million U.S. dollars worth of Bitcoin. According to a number of US media reports and the US Federal Bureau of Investigation (FBI) confirmed that the dark side of the attack was confirmed to be the DarkSide ransomware group. The FBI said it is continuing to conduct further investigations with Colonial Pipeline and government partners.
Amount of loss: $ 5,000,000 Attack method: Ransomware
Description of the event: Encrypted lending service Celsius has discovered a data breach in one of its third-party service providers, which has exposed the personal information of its customers. According to the email, the hacker gained access to the "third-party email distribution system" used by Celsius. Hackers use this information to send fraudulent emails and text messages to trick them into revealing the private keys of their funds. On April 14, Celsius users started reporting a fraudulent website claiming to be the official Celsius platform. Some users also receive text messages and emails claiming to be Celsius official, can link to the website, and prompt the recipient to enter sensitive information. It is reported that Celsius' competitor BlockFi suffered a similar data breach last spring.
Amount of loss: - Attack method: Data leak