BlockThreat - Week 16, 2025

Peter Kacherginsky

21 Apr 2025

Greetings!

Nearly $14M was stolen across six incidents this week, with the Chinese crypto underground implicated in laundering DPRK-linked funds, and latest crypto phishing techniques including DKIM replay and Calendly spoofing attacks.

Let’s start with the relatively good news: most of that was stolen and later returned in a high-profile heist involving KiloEx. The $7.5M exploit was coordinated across multiple chains and abused the same insufficient function parameter validation to gain control over the protocol’s price-setting method. After manipulating prices and rapidly opening and closing ETH positions, the attacker quickly drained the protocol.

The silver lining? The attacker accepted a 10% bounty and returned the majority of the funds, thanks to efforts from SlowMist, SEAL 911, BlockSec, and others.

Now for the less happy stuff.

A private key compromise on zkSync cost a developer $5M from airdrop-related contracts. On the one hand, it’s good the damage was relatively contained. On the other—why wasn’t a multisig slapped on anything holding more than lunch money?

Then there’s R0AR, which lost $790K due to a backdoor snuck in by one of the developers. Yet again: how was this missed in both pre- and post-deployment audits?

Finally, the rest of the week was marked by alarm bells over Elusive Comet’s latest campaign—sneaking into Telegram chats, phishing emails, and luring victims into malfunctioning Zoom calls. Stay paranoid. Please be safe and review SEAL’s advisory.

Let’s dive into the news!

News

Non-KYC exchange eXch to close down under money laundering scrutiny tied to Lazarus Group.
Phantom Wallet Sued Over $500K Meme Coin Theft Linked to Alleged Security Flaw. Unlikely to succeed, but an interesting development if picked up as a trend by other crypto theft victims.
Chinese chip used in bitcoin wallets is putting traders at risk. The article focuses on bugs/features in ESP32 chip that may allow remote private key theft from hardware wallets such as Blockstream.
Major crypto exchanges suffer complications after AWS outage.
Matra of Misfortune by Rekt. Explores a quiet cash out before the full meltdown the Mantra chain with $5B.

Crime

Policy

China debates how to handle criminal crypto cache.

Phishing

Google Spoofed Via DKIM Replay Attack: A Technical Breakdown. The technique was already used to target crypto folks.
Crypto CEO Loses $100K in Zoom Call Hack by ‘ELUSIVE COMET’.
X Account Takeover in One Click From Calendly/Calendar fake link by Louis Marquenet (Opsek).
Mitigating ELUSIVE COMET Zoom remote control attacks by Trail of Bits.
Beginner’s Guide to Web3 Security: Clipboard Risks by SlowMist.
North Korean hackers target crypto devs with fake recruitment tests.

Malware

Hacks

Detailed indicators of compromise including exploit transactions, attacker addresses, exploit PoCs are available upon request.

KiloEx

Date: April 14, 2025
Attack Vector: Function Parameter Validation
Impact: $7,500,000 (Recovered $6,750,000)
Chain: Base, BNB, Taiko, opBNB, Manta

https://x.com/CyversAlerts/status/1912868664946335888