BlockThreat - Week 25, 2021

This week 69K BTC were stolen in a massive exit scam by Africrypt exchange founders. Attackers starting to target projects hosted on Ethereum Layer 2 networks. More DeFi protocols on the Binance Smart Chain got exploited for a total loss of about $5M. Oh and be sure to read up on a new rug pull technique which exploits a weakness in Etherscan-based block explorers to hide malicious source code.

Let’s dive into the news, but first a special thank you to all of the Gitcoin Grant supporters as well as Trail of Bits who sponsored this week’s edition:

News

• Africrypt exchange founders on the run after claiming $3.6B in BTC were stolen by hackers.
• StakeHound sued Fireblocks for losing a key pair to unlock 38K ETH.
• FIN7 manager sentenced to 7 years for role in global hacking scheme.
• British Police seizes £114M worth of cryptocurrencies.
• Interview with Legendary Bug Bounty Hunter Alexander Schlindwein.

Media

• The Lazarus heist: How North Korea almost pulled off a billion-dollar hack 10 episode series by BBC.
• Total Defense: DeFi Hacks with ChainSecurity, Immunefi, and Chainalysis

Scams

• StableMagnet owners rug pulled $27M using a backdoored library. Interestingly, the scam takes advantage of a weakness in Etherscan-based explorers which do not verify linked library source code.
• Common NFT Scams to Avoid by Chris Hamer (MyCrypto).

Hacks

• On June 21, 2021 Impossible Finance LP contract design flaw was exploited which resulted in the loss of $700K. Some of the funds were returned after an unknown action by BSC team.
• On June 22, 2021 Eleven Finance withdrawal logic vulnerability was exploited which resulted in the theft of $4.5M. Some of the funds were returned after an unknown action by BSC team.
• On June 24, 2021 xWin Finance slippage control weakness was exploited which resulted in the theft of $270K.
• On June 27, 2021 SafeDollar reward logic vulnerability was exploited which resulted in the theft of $250K. Interestingly, the attack took place on Ethereum’s layer 2 network called Polygon (previously Matic).

Vulnerabilities

• Mushroom Finance fixed a logic error after it was responsibly disclosed by CKK Sec.
• SharedStake patched a timelock vulnerability thanks to a responsible disclosure report by Lucash-dev.
• WildCredit patched a reward distribution vulnerability after it was responsibly disclosed by Mudit Gupta.

Malware

• Ongoing BazarCall phishing campaign that uses call centers to infect computers with ransomware.
• Crackonosh cryptojacker malware report by Avast. Primary distribution vector is pirated gaming software such as NBA 2K19, GTA 5, and others. Do be careful when you copy that floppy
• DirtyMoe cryptojacker malware report by Avast. Modular malware is primarily distributed using spam emails pointing victims to websites hosting PurpleFox exploit pack.

Research

• Improving security for users of decentralized exchanges through multiparty computation.
• Flash Crash for Cash: Cyber Threats in Decentralized Finance.
• What is a DeFi Exploit? A Beginner’s Guide to Managing Risk by RugDoc
• Ransomware Attacks dataset and visualization.
• China FUD: Understanding China’s Recent Crypto Regulations by Deribit.

Stay informed and see you in the next week’s edition!

- Peter Kacherginsky (iphelix)