2 years ago
Reentrancy, terms oracle attacks and exploits crossed 7 protocols caused decentralized concern (DeFi) abstraction to bleed astatine slightest $21 cardinal successful crypto successful February.
According to DeFi-centric data analytics level DefiLlama, 1 of the largest successful the period was the flash indebtedness reentrancy onslaught connected Platypus Finance, which led to $8.5 cardinal of funds lost.
DefiLlama highlighted six different noteworthy hacks successful the month, the archetypal being the terms oracle onslaught connected BonqDAO connected Feb 1.
DeFi platforms suffered 7 attacks passim February. Source: DefiLlamaBonqDAO: $1.7 million
BonqDAO revealed to its followers successful a Feb. 1 station that its Bonq protocol was exposed to an oracle onslaught that allowed the exploiter to manipulate the terms of the AllianceBlock (ALBT) token.
The exploiter accrued the ALBT terms and minted ample amounts of BEUR. The BEUR was past swapped for different tokens connected Uniswap. Then, the terms was decreased to astir zero, which triggered the liquidation of ALBT troves.
Blockchain information steadfast PeckShield estimated the losses to beryllium astir $120 million, however, it was aboriginal revealed hackers reportedly lone cashed retired astir $1 million owed to a deficiency of liquidity connected BonqDAO.
Orion Protocol: $3 million
Just a time later, decentralized speech Orion Protocol suffered a loss of astir $3 cardinal connected Feb. 2 done a reentrancy attack, wherever attackers utilized a malicious astute declaration to drain funds from a people with repeated withdrawal orders.
We person been investigating this precise blase onslaught from the minutes it occurred. We volition not reopen the Deposit relation until we consciousness assured that the bug has been fixed which volition lone beryllium aft successfully passing caller audits from starring audit firms.
— Alexey Koloskov (@alexeykoloskov) February 2, 2023Orion Protocol CEO Alexey Koloskov confirmed the onslaught astatine the time, assuring everyone, "All users' funds are harmless and secure."
"We person reasons to judge that the contented was not a effect of immoderate shortcomings successful our halfway protocol code, but alternatively mightiness person been caused by a vulnerability successful mixing third-party libraries successful 1 of the astute contracts utilized by our experimental and backstage brokers," helium said.
dForce Network: $3.65 million
DeFi protocol dForce web was different February unfortunate of a reentrancy onslaught resulting successful losses of astir $3.65 million.
In a Feb. 10 post, dForce confirmed the exploit; nevertheless successful a twist, each funds were returned erstwhile the hacker came guardant arsenic a whitehat hacker.
2/5 Shortly aft the incident, we entered into conversations with the exploiter, who came guardant arsenic a whitehat. We person agreed to connection a bounty and volition driblet each on-going probe and instrumentality enforcement actions.
— dForce (@dForcenet) February 13, 2023“On Feb. 13, 2023, the exploited funds were afloat returned to our multi-sig connected some Arbitrum and Optimism, a cleanable ending for all,” dForce said.
Platypus Finance: $9.1 million
On Feb. 16, DeFi protocol Platypus Finance suffered a flash indebtedness attack resulting successful $8.5 cardinal being drained from the protocol.
A post-mortem study from Platypus auditor Omniscia noted that the onslaught was imaginable due to the fact that of code successful the incorrect order.
On Feb. 23, the squad announced that they are seeking to instrumentality astir 78% of the main excavation funds by reminting frozen stablecoins.
Updated compensation leafage
We person updated our compensation leafage today! If you person deposited oregon withdrawn LP tokens from our output aggregators earlier the excavation pause, your compensation magnitude volition beryllium updated accordingly.
More https://t.co/GfLIn5jmtF
The squad besides confirmed 2nd and 3rd incidents, which led to different $667,000 exploited, bringing full losses of astir $9.1 million.
French constabulary arrested 2 suspects related to the hack and seized astir $222,000 worthy of crypto assets connected Feb. 25.
Hope Finance: $1.86 million
A fewer days later, users of arbitrum-based algorithmic stablecoin project, Hope Finance, fell prey to a astute declaration exploit connected Feb. 20, which saw astir $2 cardinal stolen from users.
— CertiK Alert (@CertiKAlert) February 21, 2023Web3 information steadfast CertiK flagged the incidental connected Feb. 21, pursuing an announcement from the Hope Finance Twitter relationship notifying users of the scam.
A subordinate of the CertiK squad told Cointelegraph astatine the clip that the scammer had changed the details of the astute contract, which led to funds being drained from Hope Finance genesis protocol:
“It appears that the scammer changed the TradingHelper declaration which meant that erstwhile 0x4481 calls OpenTrade connected the GenesisRewardPool the funds are transferred to the scammer.”Dexible: $2 million
Multichain speech aggregator Dexible was deed by an exploit that targeted the app’s selfSwap function, with $2 cardinal worthy of cryptocurrency was mislaid arsenic a effect of the Feb. 17 attack.
According to a Feb. 18 station from the exchange, “a hacker exploited a vulnerability successful our newest astute contract. This allowed the hacker to bargain funds from immoderate wallet that had an unspent walk support connected the contract.”
Dear Dexible community, we regret to pass you that successful the aboriginal hours of February 17th, a hacker exploited a vulnerability successful our newest astute contract. This allowed the hacker to bargain funds from immoderate wallet that had an unspent walk support connected the contract.
1/5
After investigating, the Dexible squad recovered that an attacker had utilized the app’s selfSwap relation to determination implicit $2 cardinal worthy of crypto from users that had antecedently authorized the app to determination their tokens.
After receiving the tokens into their ain astute contract, the attacker withdrew the coins done Tornado Cash into chartless BNB wallets.
LaunchZone: $700,000
BNB Chain-based decentralized concern (DeFi) protocol LaunchZone had $700,000 worthy of funds drained connected Feb. 27.
According to blockchain information steadfast Immunefi, an attacker leveraged an unverified declaration to drain the funds.
"An support had been made to the unverified declaration 473 days agone by the LaunchZone deployer," Immunefi said.
Related: Crypto exploit losses successful January spot astir 93% year-on-year decline
The February figures are a stark summation from January, according to DefiLlama figures.
The tracker lists lone $740,000 successful hacks to DeFi platforms successful the period crossed 2 protocols — Midas Capital and ROE Finance.
In its 2023 Crypto Crime Report, blockchain information steadfast Chainalysis revealed that hackers stole $3.1 cardinal from DeFi protocols successful 2022l, accounting for much than 82% of the full magnitude stolen successful the year.
English (US) 