BlockThreat - Week 26, 2024
Farcana | XiaoPANG | ApeMAGA | Cardano
Greetings!
Only $284K stolen this week across 4 incidents. Quiet weeks like this is a reason to celebrate. However, after covering this space for 5+ years, I feel a bit paranoid that another major hack is just around the corner. If we look at the stats, things are definitely not improving. $1.2B were stolen in 2024 so far which is double of what we have seen in H1 of 2023 ($624M). The number of incidents is also 4x from the past year. So enjoy this brief break and gather up strength for many battles ahead.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
Let’s dive into the news!
News
- Evolve Bank leak has personal data of Bitfinex, Copper, Nomad users.
- HubSpot says it's investigating customer account hacks. This is the same CRM that leaked customer PII for BlockFi, Circle, Ledger, Pantera, and other crypto platforms in 2022. Get ready for the latest phishing wave.
- Polyfill supply chain attack hits 100K+ sites. Please check if you are impacted and maintain your dependency list. Cloudflare stepped in to redirect requests to a mirror without malicious code.
Crime
- National Power Administration ANDE Employees Allegedly Involved in Setting up Illegal Bitcoin Mining Farms in Paraguay.
- The “El Chapo” Loses Extradition Appeal and Comes to US to Face Crypto-Related Money Laundering Charges.
- Feds put $5M bounty on 'CryptoQueen' Ruja Ignatova.
- Hydrogen Technology Execs Jailed for HYDRO Price Manipulation.
- Uzbek man using 'malicious' computer software charged in $11.8 million cryptocurrency theft using a fake EOS wallet.
Policy
- SEC Charges Consensys Software for Unregistered Offers and Sales of Securities Through Its MetaMask Staking Service.
- EU draft standards deem MEV as ‘clear example of market abuse’ under upcoming MiCA rules.
Phishing
- Phishing scammer goes after Hedera users, address poisoner gets $70K.
- Fraud Alert: Fake recruiters on GitHub and LinkedIn by Heiner.
Scams
- USD 257 million seized in global police crackdown against online scams.
- Investor shares story of falling victim to $100K crypto hack.
- Logan Paul Sues YouTuber Coffeezilla for Libel Over CryptoZoo Game Allegations.
Malware
- Fake Phantom wallet targeting Solana users on Apple Store.
Media
- The Recon Pro Workflow: Invariant Testing in the Cloud by Alex the Entreprenerd.
Research
- The Effects of Ethereum's Upgrades on Smart Contracts by Toon Van Hove (Sigma Prime).
- How to analyze reports and become a great auditor by bogo.
- A Guide to Solana Token2022 (Token Extensions) by Andrew Hong.
- It’s time to talk about L2 MEV by sui414.
Tools
- Reth 1.0 released.
- EVMole - function selector and argument extractor now with Vyper support.
- Gas Playground - deploy and execute test contracts against live chain state with trace support.
Hacks
Cardano
Date: June 24, 2024
Attack Vector:
Impact: Assets Stolen, DoS
Chain: Cardano
https://twitter.com/0xMert_/status/1806270914264199480
Farcana
Date: June 24, 2024
Attack Vector: Stolen Private Keys
Impact: $164,000
Chain: Polygon
https://x.com/CertiKAlert/status/1805171670132347168
ApeMAGA
Date: June 26, 2024
Attack Vector: Price Oracle Manipulation
Impact: $32,000
Chain: Ethereum
https://twitter.com/ChainAegis/status/1806297556852601282
XiaoPANG
Date: June 27, 2024
Attack Vector: Reward Manipulation
Impact: $88,000