TronWeekly

Crypto World News

You are here: Home / Archives for Hack

Hack

WazirX Hackers Cash Out $6.5M & Vanish Into Thin Air

by

The perpetrators behind WazirX’s recent hack of July 18 have transferred a significant portion of their stolen funds. Blockchain security firm PeckShield has announced that it has identified an address linked to the hackers, which has recently sent 2600.1 ETH [worth approximately $6.5 million] to the privacy protocol Tornado Cash.

This latest transaction hints at efforts to launder the stolen funds. Tornado Cash, a popular privacy mixer, allows users to hide the origin and destination of their transactions. By using this platform, the hackers are making it more difficult to trace the stolen funds.

WazirX
WazirX Hackers Cash Out $6.5M & Vanish Into Thin Air 2

As the investigation into the WazirX hack continues, authorities and security experts are working tirelessly to track down the perpetrators and recover the stolen funds. The transfer of funds to Tornado Cash further complicates the situation, but it is hoped that law enforcement agencies will be able to use advanced techniques to trace the stolen funds and bring the hackers to justice.

In July, the leading Indian crypto exchange suffered a security breach in one of its multisig wallets, losing over $230 million [2000 crore INR] in the onslaught. on-chain sleuth  ZachXBT has submitted evidence of a KYC-linked deposit address used by the exploiter to receive funds from the WazirX exploit. The hackers orchestrated a methodical and organized attack that lasted a total of 8 days.

WazirX’s Phased Withdrawals

The incident was a major blow to the Indian cryptocurrency community, raising serious questions about the security of cryptocurrency exchanges and the need for stronger measures to protect user funds.

Not only that, the event hugely disrupted the platform’s operations, mandating a temporary freeze in withdrawals and traders’ activities as WazirX works on gaining situational awareness and recovery strategies. After careful evaluation, the company announced that INR withdrawals resumed on August 26, 2024.

This phased approach will begin with the capability to withdraw half of the 66% limit from August 26 to September 8, 2024, and then the full limit from September 9 to September 22, 2024. To facilitate this, withdrawal fees will be reduced by 60%, from INR 25 to INR 10.

Terra Chain Halted For Suspected Exploit

by

User activity on the Terra blockchain came to an abrupt pause following reports of a suspected exploit. The team swiftly executed an emergency halt at block height 11,430,400 to address the illegal breach. During this period, all transactions were suspended, leaving users anxiously awaiting updates.

Taking immediate action, the Terra team worked together with validators to deploy an emergency patch. This critical move was aimed at addressing the suspected breach and safeguarding the integrity of the blockchain. The team stated that the chain halt was a necessary precaution to prevent any potential malicious activities during the patch implementation.

Terra
Terra Chain Halted For Suspected Exploit 4

The Terra chain has resumed block production at approximately 4:19 AM UTC today and the emergency chain upgrade is now complete. Transactions are now being processed, and users may resume normal activities. Validators holding over 67% of the voting power on the chain have upgraded their nodes to prevent the exploit from recurring. More validators are expected to upgrade soon.

At approximately 4:19 AM UTC, Terra successfully resumed block production after the completion of the emergency chain upgrade without any major hiccups. This allowed transactions to be processed once again.

Terra: Majority Validators Upgrade to Prevent Future Exploits

It was noteworthy to highlight the swift response from validators who have successfully upgraded the nodes following the instructions. They hold over 67% of the voting power on Terra. These validators’ crucial responses likely prevented further occurrence of the exploit. The team stated that more validators are expected to follow suit, strengthening the network’s resilience against such threats.

With the chain back online, the Terra team continues to monitor the situation closely. Users are encouraged to stay informed through official channels for any further updates or instructions. The proactive measures taken by the team and its validators demonstrate a robust commitment to security and user protection in the face of potential threats.

The hack was a major scare, especially as it occurred close to Terraform Labs’ August 9th deadline for submitting claims in its bankruptcy proceedings. This incident underscores the urgency and importance of robust security measures for blockchain platforms, particularly during critical financial transitions.

Crypto Hack Spree: $67 Million Loss Sparks Security Concerns In February 2024: Report

by

The unfortunate February 2024 event series shocked the crypto world’s financial system; as a result, the system lost $67 million. The main part of the misfortune involved hacks(accounted for 97.54% of the total damages), whereas the remaining came from frauds, which were not significant. The figure, however sad, came as a small relief compared to the January situation in which more crypto security measures were taken, or investors observed more caution.

According to the report by ImmuneFi, for the month under review, the crypto market was writhing in the consequences of hacks and scams to a whopping loss of $200 million. Sadly, the two entities that faced the most damage were PlayDapp, a cryptocurrency-based game platform, and FixedFloat, a decentralized exchange, which reported losses of $32.35 million and $26.1 million, respectively. Crypto casino Duelbits also suffered a major blow when it lost $4.6 million to bad actors’ activity. Collectively, these events amounted to the expenses of $63.05 million by the end of the month.

Crypto Landscape In February 2024

Ethereum, the leading smart contract platform, was the subject of a dozen attacks in February. On the other side, both BNB Chain and Bitcoin have also faced one hack. The decentralized finance (DeFi) sphere became the principal victim, with a staggering 97.54% of the losses occurring in this sector, while CeFi platforms remained generally unaffected.

The cumulative costs for the whole crypto segment of the industry increased to $200 million, equivalent to a 15.4% growth compared to the same timeframe for the past year. To illustrate, some cases were not included in the January and February news reports, like that on Seneca, LastPass users, MIM stablecoin, and the $112 million attack on the digital wallet of the co-founder of Ripple, Chris Larsen. Other than the exclusions, the loss for March could have amounted to $198.1 million to make a year-to-date total of $398.1 million.

The DeFi hacks of recent times prove how security in the crypto world is a matter of real concern that needs to be enhanced. This encompasses a joint effort between platforms and security experts to find the crack and fix it, making the digital asset system more resilient and better prepared in the event of similar malicious actions.

Federal Officer Accused Of Bitcoin Theft Using Crypto Tracing Software

by

The National Anti-Corruption Commission (NACC) of Australia is accusing a federal police officer of having lost 81.62 Bitcoin (BTC) stored in a Trezor hardware wallet, which was recovered at the crime scene. The allegation relies on advanced crypto-tracking tools that unravel a great network of digital transactions that lead back to the perpetrator.

Following the raiding of a residential premise by the Australian authorities, the wallet was discovered only to be faced with a baffling discovery upon accessing it weeks later.  According to a recent report, the $309,000 BTC hoard taken during the 2019 operation has become untraceable, with the authorities claiming that it was stolen by an officer William Wheatley after the investigation.

Crypto Detective Software Unveils Alleged Bitcoin Heist

The current valuation of these digital assets that is close to $4.2 million USD has triggered an unparalleled legal clash. Detective Sergeant Deon Achtypis, who was leading the cybercrime squad, initially theorized that an insider within the criminal network was behind the heist.

It took an interesting twist after the discovery of a very vital piece of evidence device that had a seed phrase to the stolen hardware wallet. This important data, a combination of random-word-sequence, unintentionally open the door to the investigators for chasing the footprint of the Bitcoins.

The employment of the crypto tracing software, the fast-growing phenomenon among law enforcement agencies worldwide, gave the police some additional leverage in the case of Wheatley. The software, carefully examining the IP addresses related to the unlawful transaction, in the end, traced a very damning link back to the accused officer.

The integration of such advanced technologies resonates with the ever-increasing efforts by the enforcement agents to fight the illegitimate activities in the Bitcoin and other digital currencies. Noteworthy, in August 2023, The Canadian police force’s adoption of the Chainalysis Reactor was announced, which indicates a unified fight against crypto-related crimes.

Additionally, gaining strides in the crypto forensic software increase the amount of recovered stolen Bitcoins. The stats of the current year unveiled the total amount which was outstanding at $674 million, gained from the more than 600 big-scale crypto-hacks this year, showing the effectiveness of the those technology.

In the face of the amassing allegations, Wheatley stands firm in his own innocence and adamantly denies the many charges of corruption involving the office and also his role in the criminal activities. During the continuance of the legal proceedings, Wheatley doesn’t give up on the challenging of the charges that are subjected to him, this way the court case is dragged on and on.

This trend evolves amidst the Trezor’s disclosure of a malicious hack which affected over tens of thousands of the users – a development which heightens the speculation about the safety and depository of the digital assets in the dawn of digital currency.

Poloniex Hacker Offered $10 Million Bounty To Return Stolen $114 Million

by

In a groundbreaking move within the cryptocurrency world, the perpetrator behind the recent staggering $114 million hack on Poloniex, one of the pioneering exchanges, has been given a request to return the stolen funds within seven days and receive a generous $10 million reward or face the unified force of law enforcement from multiple countries.

Justin Sun, a prominent figure in the crypto space, revealed that the Poloniex team had successfully identified the individual responsible for the Nov. 10 cyber intrusion. Using an unconventional approach, Sun conveyed this message to the perpetrator through an on-chain statement attached to a transaction sent to the attacker’s digital address.

Utilizing multiple languages, including Chinese, English, Russian, and Korean, the statement was transmitted via an input data message (IDM) originating from one of Sun’s Ethereum wallets, specifically labeled as address 0x176F3DAb24a159341c0509bB36B833E7fdd0a132.

f2riMMhMSzmZQL 9YWuzRorqjGnFsmF1xfIC5AaHdyismimIHUzsQ0MPVzQJ0VOLUn7tRSJtEzPodwvW3oFH9NKBSL8OXkU SUNUPW95nN1JTApfmCrREeLTn9NNIVJ5pimFRKQIAlLCHmenbFA kJY

$5.7 Million Bounty Offer Falls Flat After Poloniex Hack

Poloniex suffered a major cyber breach that resulted in the loss of 3.1 million XRP, 32 million US Dollar Tethers (USDT), around 284 Ethers (ETH), 86.5 Wrapped Bitcoins (WBTC), and several TRC-20 tokens from their wallets. Justin Sun offered a 5% bounty following the hack, nearly $5.7 million. Still, the hacker did not respond.

Poloniex has recently announced that it is nearing completion of the necessary steps to restore operational functionality and resume its routine trading activities. The exchange also initiated a rigorous security audit to enhance its defenses against threats. As of November 15, Poloniex reported that the audit is underway. Once concluded, the exchange anticipates it will be confident to continue its operations as usual.

The Poloniex breach of 2023 is one of the largest cryptocurrency attacks in recent times. The only larger breach occurred earlier that year when hackers made off with over $190 million during the Euler Finance incident on March 13th. In contrast to the swift resolution of the Euler attack, where the funds were returned within a month, the Poloniex breach represents one of the most significant “black hat” cyberattacks within the cryptocurrency realm over the past year. 

AlphaPo Hack Culprit Uncovered: Estimated Loss Now At $60M

by

A hack on AlphaPo, a crypto payment platform, shook the internet recently after security experts spotted the pilferage of at least $31 million from its hot wallets. ZachXBT, an eccentric on-chain investigator who was deeply interested in the situation, claimed that the funds had been taken from the Ethereum network, exchanged for ETH, and then bridged to the Avalanche and Bitcoin blockchains.

Since the number of Bitcoins taken at the time was unknown, market experts worried that the loss would be greater than initially reported. Unfortunately, ZachXBT’s suspicions were realized when he learned that an additional $37 million worth of TRON and BTC were looted, bringing the total amount of theft to $60 million.

ZachXBT also suggested that the dreaded North Korea-based Lazarus Group might have carried out the attack, as they create a very distinct fingerprint on the chain. While investigations are currently in progress, DeDotFi’s security team stated then that the hack may have been caused by a leak of private keys.

AlphaPo is a payment processor that allows quick transactions in more than 30 digital assets and balances in a variety of fiat currencies. The company is primarily recognized for serving as the cryptocurrency gateway for several gambling websites, including HypeDrop, Ignition, and Bovada.

According to security analysts, Lazarus, a group notorious for attacking cryptocurrency institutions like the Ronin Network and Harmony’s Horizon Bridge, recently infiltrated U.S. enterprise software provider JumpCloud to target its cryptocurrency clients.

Hunt Begins For Lazarus Hackers

JumpCloud, a directory platform that enables businesses to authenticate, authorize, and manage users and devices, disclosed that the nation-state actor was also responsible for a June system breach that compelled the company to reset its clients’ API keys.

While JumpCloud didn’t at the time pin blame on the dreaded hacker’s group, several cyber security researchers like CrowdStrike, SentinelOne, and Mandiant have attributed the attack to the North Korea-backed hackers.

U.S. officials announced fresh penalties against North Korea’s army of illegal IT employees in May as part of efforts to stop the state-sponsored, anonymous hackers. They contend that these individuals have obtained employment abroad fraudulently to fund the regime’s development of WMD. Additionally, the US State Department is offering up to $10 million in incentives for information that will stop North Korean hackers.

Tether Blacklists Suspicious FTX Wallets, Loses $27.5M On SOL

by

Despite the CEO purportedly seeking other support companies, Tether said it has no plans to spend money on FTX. Cryptocurrency exchange FTX has lost at least one potential savior as it tries to plug a supposedly multi-billion dollar hole in its financial statement. The stablecoin team has now decided to step it up by blocking suspicious FTX wallets.

The entity responsible for the enigmatic financial transfers associated with FTX cryptocurrency wallets has begun selling off token holdings from different networks.

Early Asian morning, just following news of a hack at FTX, saw the sale of more over $12 million in chainlink (LINK) tokens over the course of two transactions. The fact that the organization made a profit of just under $10 million after slippage, which refers to losses incurred by a market participant when they receive a different deal execution price than anticipated, suggests that the entity was scrambling to dispose its assets.

Separately, activities on the Polygon blockchain connected to the account drainer’s wallets revealed that 3 million MATIC tokens were sold for $2.4 million.

Tether Loses $3.9M On AVAX And $27.5M On SOL Linked To FTX Wallets

According to ZachXBT, a pseudonymous blockchain investigator, certain funds connected to the wallets used by the account drainer to sell tokens on the Avalanche and Solana networks earlier this morning appear to have been frozen by stablecoin issuer Tether.

Tether has blacklisted over $3.9 million USDT on Avalanche and $27.5 million USDT on Solana connected to the FTX account drainer.

Bankman-Fried is alleged to have approached Tether, the cryptocurrency exchange OKX, and the venture capital company Sequoia Capital for funding. According to reports, he has asked each organisation for at least $1 billion.

The CTO’s response appears to echo the perspective Tether stated in a blog post on November 9 assuring the community that it has no exposure to Alameda or FTX. On November 10, the stablecoin issuer reportedly froze 46,360,701 USDT held by FTX in its Tron blockchain wallet in order to work with law enforcement. Whether OKX or Sequoia Capital are considering aiding the struggling exchange is unknown at this time.

FTX Hack Leads To Mysterious Outflows Of Over $600M

by

Late on Friday, more than $600 million in cryptocurrency vanished from the wallets of the defunct cryptocurrency corporation FTX, with no obvious reason given. Soon after, the exchange announced that it had been hacked in its official Telegram channel and advised users not to install any new updates and to delete all apps related to the exchange.

An account administrator in the firm’s Support Telegram chat wrote,

“FTX has been hacked. FTX apps are malware. Delete them. Chat is open. Don’t go on FTX site as it might download Trojans,”

Ryne Miller, general counsel for the exchange, confirmed the message.

https://twitter.com/_Ryne_Miller/status/1591281729125613570?s=20&t=Hv90HEUWoeAGxfPMu-Q60g

Various Ethereum tokens, as well as the Solana and Binance Smart Chain tokens, have left the exchange’s official wallets and transferred to decentralized exchanges like 1inch, according to on-chain statistics. It appears that both the exchange and its US venture are impacted.

Hack and FTX Filing For Bankruptcy Interlinked?

The transfers occur on the same day that the exchange formally filed for Chapter 11 bankruptcy protection after losing allegedly billions of dollars in user payments. The transfers have not been officially acknowledged by the firm’s leadership.

Numerous owners of the exchange’s wallets have also reported seeing $0 balances in their firm’s website and the firm’s US wallets. This can be due to the FTX API being unavailable.

FTX founder Sam Bankman-Fried was the target of filthy jokes and insults that were apparently included in some of the transactions. This led to quick speculation on Twitter from members of the cryptocurrency community that the funds had been syphoned off as part of some sort of attack.

Some others hypothesized that someone in Bankman-inner Fried’s circle was behind the outflows, citing the simultaneous and sophisticated hacks of the exchange and its US branch as evidence of a possible inside job. ” Multiple former FTX employees confirmed to me that they do not recognize these transfers,” Twitter sleuth ZachXBT wrote in a tweet on Friday night.

With names like “cumsock.eth” and “downsyndromemonkey.eth,” many of the transactions seemed to be trolls when the wallet address became known, seeking to have their vanity names permanently inscribed in a ledger that would likely be submitted as a court document and read aloud by a judge.

By midnight Eastern Time, FTX’s login interface was down (the website is still up), and anyone who attempted to log in received a 503 error. A 503 error occurs when the server is down, usually because it is being serviced or is not accessible.

Solana DeFi Exploiter Will Return “Bad Debt”… On One Condition

by

Solana-powered decentralized finance [DeFi] lending protocol Mango Markets recently suffered a massive exploit to the tune of $100 million, where the attacker reportedly manipulated the oracle’s smart contract.

After the team offered a bounty in exchange for the return of the stolen assets, the hacker/s made a proposal on Mango Governance that they would send back those assets but under one condition and that was utilizing $70 million USDC from Mango’s treasury to repay the “bad debt” within the protocol.

The negotiation agreement also specified that once the tokens are returned, no criminal investigations would be opened.

By voting for this proposal, mango token holders agree to pay this bounty and pay off the bad debt with the treasury, and waive any potential claims against accounts with bad debt, and will not pursue any criminal investigations or freezing of funds once the tokens are sent back as described above.

For the uninitiated, this bad debt is the result of a rescue plan developed by Mango Markets and the competing Solana lending platform Solend for a major Solana whale with $207 million in debt dispersed across several lending platforms.

The whale had once borrowed 88% of the USDC that was available on Solend.

The rescue was put together because of concern that the whale’s bets would be liquidated if the SOL token fell another 20%, which would spread and have a negative influence on the Solana ecosystem.

Solana Exploiter May Have Rigged The Voting Proposal

At the time of writing this post, 32 million “yes” was garnered from the attacker’s proposal. Meanwhile, crypto Twitter is abuzz with the proposal’s absurdity amidst speculations that the voting process has been rigged by the exploiters to favor them.

That being said, online sleuths continue to dig deeper into the exploit. According to the blockchain auditing website OtterSec, the attacker addresses were funded 5.5 million via FTX. Not just Solana oracles, the attacker also appeared to exploit prices across all exchanges.

Mango Markets is a Solana-based platform for trading digital assets on the Sol blockchain for spot margin and trading perpetual futures. The protocol is governed by Mango DAO.

Following the latest incident, its native token MNGO token has shed its value by more than 40% in the last 24 hours.

The team behind the DeFi trading platform later updated that withdrawals are temporarily halted to prevent any further unnecessary losses. “To make sure depositors of the Mango protocol are made whole and to try and salvage some value in Mango DAO and protocol to rebuild from here”, it added.

Solana Phantom Hackers Lure Users by Sending Fake Security Updates

by

Hackers seem to be forever targeting Solana. Unknown hackers have been distributing nonfungible tokens (NFTs) to Solana crypto users over the past two weeks while disguising them as a new Phantom wallet security update. However, the NFTs are actually malware that is intended to steal the users’ money.

As per BleepingComputer, the hackers are utilizing NFTS called “PHANTOMUPDATE.COM” or “UPDATEPHANTOM.COM” and are posing as members of the Phantom team.

Users are informed when they open the NFT that a new security update for the Phantom wallet has been released and can be downloaded using the included link or the mentioned website.

The mail emphasizes urgency by warning that skipping the phony security update “may result in a loss of cash owing to hackers abusing the Solana network.”

image 14
Solana Phantom Hackers Lure Users by Sending Fake Security Updates 8

Analysts believe it might be related to the Solana wallet hack

The Solana-based wallet heist, which resulted in the theft of almost $8 million from 8,000 wallets in August, such as those belonging to Phantom wallet users, is probably what prompted the urgency element. Later, it was discovered that Slope, a Web3 wallet service built in Solana, had security flaws.

If a victim follows the bogus Phantom update instructions, malware that attempts to steal the user’s browser data, history, cookies, passwords, SSH keys, and other information is downloaded from GitHub.

It is advised that users who may have unintentionally fallen victim to this fraud take security steps such as running an antivirus check on their computer, protecting their cryptocurrency holdings, and changing the passwords on sensitive websites like bank accounts and cryptocurrency trading platforms.

The windll32.exe program, according to VirusTotal, is a password-stealing virus that tries to collect browser data, including history, cookies, and passwords, as well as SSH keys and other details.

Earlier efforts sent a program with the name lib64.exe [VirusTotal], which was known to be MarsStealer, even though the particular password-stealing malware that is now propagating is unclear.

A data-stealing malware software called MarsStealer, which was first released in 2020, steals data from many crypto extensions and wallets and all commonly used web browsers.

The aim of this effort is presumably to acquire crypto wallets and passwords so that threat actors may steal all bitcoin funds and access the victim’s other accounts.