​Layer 2’s first hacking incident, fraud has a new trick to forge ID cards and steal coins

According to data from the PeckShield situational awareness platform, in the past month, a total of 33 prominent security incidents occurred in the entire blockchain ecosystem. There were 12 cases involving DeFi, 2 cases of exchange security, 1 case of wallet security, 1 case of smart contract security, 6 cases of other security events, and 11 cases of fraud.

From the perspective of segmented tracks, according to PeckShield statistics, a total of 12 DeFi-related security incidents occurred in April, with a loss of nearly 125 million US dollars, and DeFi attacks showed an explosive trend.

With the explosion of the DeFi ecosystem, more and more funds are in the liquidity pool, and hacker attacks have also entered a period of high incidence. Any code loopholes may cause losses of millions of dollars.

Data: Binance’s soul-bound Token BAB cumulative total minted exceeded 200,000: Jinse Finance reported that according to the latest data from Dune Analytics, BNB Chain’s soul-bound Token BAB’s accumulative minted total has exceeded 200,000, which was 201,173 at the time of writing Among them, the number of revoked Tokens is 2,942, and a total of 198,231 tokens have been effectively minted. According to Binance’s previous statement, BAB will serve as the identity proof for users who have completed KYC. Users can mint BAB Token on BNBChain as an identity certificate, and participate in the construction of multiple projects and receive rewards. [2022/9/13 13:26:29]

On April 5, the DeFi quantitative hedge fund Force DAO was attacked and a total of 183 ETH (approximately $367,000) of FORCE tokens were liquidated.

On April 6, a hacker attack occurred on Polkatrain. Hackers used similar slippage problems to carry out malicious attacks on POLT projects and stole about 50,000 DOTs.

Encryption technology company WonderFi Technologies will acquire blockchain development company Blockchain Foundry: Jinse Finance reported that North American blockchain development company Blockchain Foundry announced that it has reached a definitive agreement with encryption technology company WonderFi Technologies, WonderFi will acquire all issued by Blockchain Foundry and outstanding shares.

The transaction has been unanimously approved by the Boards of Directors of WonderFi and Blockchain Foundry. Blockchain Foundry's directors and officers collectively own 20.01% of its issued and outstanding common stock.

Blockchain Foundry develops and commercializes blockchain-based business and consumer solutions, focusing on infrastructure for digital assets and NFTs, and also launched the NFT minting platform and marketplace LastKnown in January 2022. WonderFi aims to improve access to digital assets through centralized and decentralized platforms. It owns encrypted asset trading platforms Bitbuy and Coinberry. [2022/9/2 13:03:15]

On April 7, the algorithmic stablecoin Fei had a loophole in the incentive calculation. The project party stated that it would stop all FEI minting rewards; Fei was unanchored and fell to $0.77 at one point.

Executive Director of ARK36: CBDC May Threaten Stablecoins, Not Bitcoin: June 24, Mikkel Morch, executive director of digital asset hedge fund ARK36, believes that state-backed digital currencies like the U.S. dollar are not necessarily a competition for cryptocurrencies opponent. Because the use cases and value propositions of cryptocurrencies “often go beyond simple transactions.” Central bank digital currencies (CBDCs) do not pose any immediate threat to cryptocurrencies such as Bitcoin (BTC), but could threaten stablecoins. (Cointelegraph)[2022/6/24 1:29:47]

On April 19, the DeFi lending protocol EasyFi was hacked. The hacker obtained the administrator key and transferred USDT, USDC, and DAI worth $6 million in stablecoins from the protocol pool; at the same time, 2.98 million EASY tokens were transferred to into their wallets and lost more than $70 million.

On April 21, AutoFarm, a DeFi income aggregator, made a strategy error and lost about 1%, involving USDC and USDT Venus strategy pools. The reason for this loss was that Venus, the largest lending platform on BSC, officially charged a withdrawal fee of 0.01%, but Belt, Autofarm and other smart gun pools did not adjust their strategies in time.

Musk replied to netizens saying that "Bitcoin can cure cancer": On November 20th, Tesla founder Elon Musk posted a message with a picture saying that (when there is no mobile phone) is a simpler time. Later, some netizens said, "Bitcoin can solve this problem." In response, Musk responded that "Bitcoin (can) cure cancer."

Note: Not a Cell Phone in Sight is a popular meme on Twitter, insinuating that the emergence of smartphones makes people lose contact with their surroundings. The copywriting reads "There are no mobile phones in sight, just people who live in the moment" [2021/11/20 7:01:27]

On April 28, a serious vulnerability occurred in the smart contract code of the DeFi project Uranium Finance, and the attacker took away $50 million.

Under traditional conditions, hackers mainly rely on their advantages in computer technology when attacking the financial system, but in the existing DeFi ecosystem, due to the interoperability between chains and applications is not so good , so the probability of arbitrage between cross-chains and cross-applications may be greater. At this time, even a person with not so strong computer skills can become a hacker and attack the DeFi system as long as he has enough financial knowledge and enough market sense.

In addition, with the vigorous development of DeFi, the opening of assets (the smooth internal transfer path) is also expanding rapidly, which requires cross-chain assistance, but there are also hidden risks, that is, hackers quickly transfer assets from one chain to another , increasing the time and space cost and difficulty of tracking stolen assets.

PeckShield recommends that investors do due diligence before participating in DeFi projects, such as inquiring and verifying whether the project has undergone a comprehensive and professional security audit, and try not to participate in projects that have not passed any security audits. When it comes to safety audit projects, we should not relax our vigilance, and we need to be rational at all times.

Peck Shield

Exchange attack

According to PeckShield statistics, there were two typical exchange security incidents in April. The security incident with a greater impact was on April 22. The founder of the Turkish encryption exchange Thodex was suspected of running away, and users were unable to withdraw encrypted assets stored in Thodex. Thodex has committed fraud, and its lawyers say the amount involved may be in the hundreds of millions of dollars.

Scam

According to CoinHolmes, an anti-fraud situational awareness system under PeckShield, there were 11 fraud-related security incidents in April.

In the context of the vigorous development of blockchain finance and digital currency, virtual currency fraud methods are updated quickly, difficult to track, and easy to launder, which brings new challenges to the global police. case:

Fake ID documents, tens of millions of virtual currency stolen

The "hacker gang" invaded the virtual currency platform, stole user information, forged documents, reissued mobile phone cards in the business hall, and stole 10 million worth of radar coins in the account. A few days ago, this criminal gang was captured by the Longgang Public Security Bureau of the Daqing City Public Security Bureau. According to the police, this type of criminal method is very rare in the country, and it is the first such case cracked in Heilongjiang.

It is reported that this "hacker gang" mainly makes profits by forging documents and reissuing other people's mobile phone cards. It is headed by Zhang, and Li, Lin, Tang, Kuang, and Li are offline, and Zhang has another online , provide him with the mobile phone number of the target person.

Before the incident, Zhang obtained Liu’s mobile phone number online, first contacted the offline Kuang, checked the owner’s identity information through the mobile phone number, and then applied for a fake certificate; then contacted the offline Li, saying that he needed to find someone Go to the location of the mobile phone number to replace the card. After Kuang obtained Li's bare-headed photo, he made a fake certificate, and Zhang contacted Tang, asking him to lead Li to make up the card with the fake certificate.

In addition, Zhang Moujie, Zhang’s upline, is responsible for providing him with the mobile phone number that needs to be reissued. If the reissue is successful, the virtual currency bound to the mobile phone card number will be given to him at a 30% commission equivalent to RMB. "Zhang Moujie told me that he made hundreds of thousands of dollars this time." In this case, Zhang Mou made a profit of 170,000 yuan from Zhang Moujie, and then distributed it.

Self-taught programming 'hacker' steals 50 million virtual currency assets

After purchasing thousands of Ethereum (ETH) virtual currency assets, Zhang from Neijiang, Sichuan Province stored them in his mobile phone and kept the private key close to him, hoping to increase the value of his investment. On September 25 last year, he discovered that all the Ethereum had been transferred. On April 14 this year, according to information from the Neijiang Public Security Bureau, his Ethereum was stolen by a man who taught himself how to hack. Estimated at the current market price, the value of its stolen blockchain assets is about 55 million yuan. At present, the suspect has been arrested.

Tags：

Tron