每月动态 | Web3 安全事件总损失约 4.04 亿美元

币圈资讯 阅读:36 2024-04-22 04:50:32 评论:0
美化布局示例

欧易(OKX)最新版本

【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   全球官网 大陆官网

币安(Binance)最新版本

币安交易所app【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

火币HTX最新版本

火币老牌交易所【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

概览

据慢雾区块链被黑档案库(https://hacked.slowmist.io) 统计,2024 年 2 月,共发生安全事件 28 起,总损失约 4.04 亿美元,原因涉及合约漏洞、DDoS 攻击、闪电贷攻击、私钥泄露和账号被盗等。

主要事件

Phantom

2024 年 2 月 2 日,加密钱包 Phantom 表示遭 DDoS 攻击,有人试图过载其系统,一些服务可能会暂时中断,用户资产安全。随后,Phantom 在推特发文表示,所有服务已恢复正常并再次顺利运行。

 (https://twitter.com/phantom/status/1753100432145318116)

Starlay Finance

2024 年 2 月 8 日,Polkadot 生态的借贷协议 Starlay Finance 遭攻击,损失约 210 万美元。2 月 9 日,Starlay Finance 发推称初步分析表明,此次攻击是由于流动性指数计算错误被利用,导致未经授权的提款。

(https://twitter.com/starlay_fi/status/1755856271184654360)

PlayDapp

2024 年 2 月 10 日,区块链游戏平台 PlayDapp 遭攻击,黑客的地址被添加为铸币者,铸造 2 亿枚 PLA 代币(约 3650 万美元)。事件发生后不久,PlayDapp 通过链上交易给黑客发送消息,要求归还被盗资金并提供 100 万美元白帽奖励,但最终谈判失败。2 月 12 日,PlayDapp 遭二次攻击,黑客又铸造了 15.9 亿枚 PLA 代币(约 2.539 亿美元)并开始通过加密货币交易平台转移。据统计,黑客攻击导致约 2.9 亿美元的损失。

(https://twitter.com/playdapp_io/status/1756060784692736038)

Duelbits

2024 年 2 月 14 日,加密博彩平台 Duelbits 的热钱包遭攻击,损失约 460 万美元,被盗原因疑为私钥泄露。

(https://twitter.com/Duelbits/status/1758159495807541459)

FixedFloat

2024 年 2 月 17 日,根据链上数据,加密货币交易平台 FixedFloat 遭攻击,损失约 2610 万美元的比特币和以太坊。FixedFloat 针对此次攻击事件澄清:这次黑客攻击是由于安全结构中的漏洞引起的外部攻击,并不是由员工所实施,用户资金并未受到“外部攻击”的影响。2 月 18 日,FixedFloat 在推特表示:“确认确实存在黑客攻击和资金被盗的情况,我们尚未准备好就此事发表公开评论,因为我们正在努力消除所有潜在的漏洞、提高安全性并进行调查。FixedFloat 的服务将很快会恢复,稍后将提供有关此事件的详细信息。”

(https://twitter.com/FixedFloat/status/1759216185185288653?s=20)

Blueberry Protocol

2024 年 2 月 22 日,DeFi 借贷协议 Blueberry Protocol 遭攻击,损失约 457.7 ETH (约 135 万美元),该攻击被一位白帽黑客 c0ffeebabe.eth 拦截,366 ETH 被返还给了 Blueberry Protocol。据 Blueberry Protocol 的事件分析报告显示,此次攻击是由于预言机部署错误导致。

(https://medium.com/@blueberryprotocol/2-22-24-exploit-post-mortem-6f6be7c1dcc3)

BitForex

2024 年 2 月 23 日,总部位于香港的 BitForex 加密货币交易平台疑跑路,其在多个区块链上发生约 5650 万美元的可疑资金外流后关闭了平台的访问权限。链上侦探 ZachXBT 最先注意到了该交易所的提款异动,他指出,该交易平台已停止处理提款,并且没有回复客户。该公司于 2023 年中因无证经营在日本面临监管审查,并被指控夸大交易量。其首席执行官于一月份辞职,承诺将由新团队接任。

(https://twitter.com/zachxbt/status/1762028433574650347)

Jihoz

2024 年 2 月 23 日,Axie Infinity 联合创始人 Jihoz 在推特发文表示:个人的两个地址已泄露。此次攻击的范围仅为其个人账户,与 Ronin 链的验证或运营无关。此外,泄露的密钥与 Sky Mavis 的运营无关。他想向大家保证,已对所有连锁相关活动都采取了严格的安全措施。据统计,此次攻击导致约 1000 万美元的损失。

(https://twitter.com/Jihoz_Axie/status/1760845078757511562)

Seneca

2024 年 2 月 28 日,全链 CDP 协议 Seneca 因合约漏洞遭黑客攻击。黑客利用构造的 calldata 参数,调用 transferfrom,将授权到该项目合约的代币转移到自己的地址上,最后兑换为 ETH。Seneca 被黑客盗走超 1900 枚 ETH,价值约 650 万美元。2 月 29 日,Seneca 黑客将 1537 枚 ETH(约 530 万美元)返还到 Seneca 部署者地址。

 (https://twitter.com/SlowMist_Team/status/1762865505042645010)

Shido Network

2024 年 2 月 29 日,Ethereum 链上去中心化的跨链协议 Shido Network 疑跑路。SHIDO 代币质押合约的所有者首先升级了质押合约,然后提取了大量的 SHIDO,最后以 692 枚 ETH(约 210 万美元)的价格抛售了大量的 SHIDO。

总结

在本月 28 起主要安全事件中,有 2 个项目(Blueberry Protocol 和 Seneca)共计追回约 638 万美元的被盗资金;本月 3 起私钥泄露事件的损失约达 3.04 亿,约占本月安全事件总损失的 75%,慢雾安全团队建议用户和项目方加强对私钥的保护措施,例如使用硬件钱包、离线存储等方式,提高私钥的安全性;本月 4 起合约漏洞利用事件导致约 725 万美元的损失,慢雾安全团队建议项目方始终保持警惕并定期进行安全审计,跟踪和解决新的安全威胁和漏洞,最大程度地保护项目和资产安全。最后,本文收录的事件为本月主要安全事件,个人用户被盗事件未纳入统计。


Overview According to the statistics of slow fog blockchain hacked archives, the total loss since the security incidents occurred in September is about 100 million US dollars. The reasons involve contract loopholes, lightning loan attacks, private key leakage and account theft, and other major events. The encrypted wallet indicates that someone tried to overload its system, and some services may temporarily interrupt the security of users' assets. Later, it tweeted that all services have returned to normal and are running smoothly again. The loss caused by the attack on the ecological loan agreement is about 10,000 US dollars. The analysis shows that the attack was caused by the misuse of the liquidity index, which led to the unauthorized withdrawal of the blockchain game platform. The hacker's address was added to make hundreds of millions of tokens for the coin maker. Shortly after the incident, he sent a message to the hacker through online trading, asking for the return of the stolen funds and providing a white hat reward of 10,000 dollars. However, in the end, the negotiation failed, and the hacker was attacked again. He made hundreds of millions of tokens and began to transfer them through the cryptocurrency trading platform. According to statistics, black. The hacker attack caused a loss of about $100 million. The hot wallet of the encrypted gambling platform was attacked and lost about $10,000. The reason for the theft was suspected that the private key was leaked. According to the data on the chain, the encrypted currency trading platform was attacked and lost about $10,000. Bitcoin and Ethereum clarified that the hacker attack was caused by a loophole in the security structure, and the external attack was not carried out by employees. The user's funds were not affected by external attacks. On March, they confirmed that there were hackers. We are not ready to make a public comment on the attack and the theft of funds, because we are working hard to eliminate all potential loopholes, improve security and investigate. The service will be resumed soon. We will provide detailed information about this incident later. The loan agreement was attacked and lost about 10,000 US dollars. The attack was intercepted by a white-hat hacker and returned to Hong Kong. According to the incident analysis report, the attack was caused by the wrong deployment of the Oracle, which led to the cryptocurrency headquartered in Hong Kong. The trading platform was suspected of running away. After the suspicious capital outflow of about 10,000 US dollars occurred in several blockchains, the access authority of the platform was closed. The detectives in the chain first noticed the withdrawal change of the exchange. He pointed out that the trading platform had stopped processing withdrawals and did not reply to customers. In the middle of the year, the company faced regulatory review in Japan for operating without a license and was accused of exaggerating the trading volume. Its CEO resigned in January and promised that a new team would take over. The co-founder tweeted that he had two individuals. The address has been leaked. The scope of the attack is only that his personal account has nothing to do with the verification or operation of the chain. In addition, the leaked key has nothing to do with the operation of the chain. He wants to assure everyone that strict security measures have been taken for all chain-related activities. According to statistics, the attack caused a loss of about 10,000 US dollars. The whole chain agreement was hacked due to contract loopholes. The hacker used the constructed parameter call to transfer the tokens authorized to the project contract to his address, and finally converted them into super-coins stolen by hackers, worth about 10,000 US dollars. Dollar Month Day Hackers return about $10,000 to the deployer's address Year Month Day Chain Centralized Cross-chain Agreement The owner of the suspected running token pledge contract first upgraded the pledge contract, then extracted a large number, and finally sold a large number of summaries at a price of about $10,000. Since this month, there has been a project in major security incidents and the stolen funds totaling about $10,000 have been recovered. Since this month, the loss of the private key leakage incident has reached about 100 million, accounting for about the total loss of this month's security incidents. The slow fog security team suggested users and items. The destination party strengthens the protection measures for the private key, such as offline storage of hardware wallet, etc. to improve the security of the private key. Since this month, the contract vulnerability exploitation incident has caused a loss of about 10,000 US dollars. The slow fog security team suggested that the project party should always be vigilant and conduct regular security audits to track and solve new security threats and vulnerabilities to protect the project and assets to the greatest extent. Finally, the incidents included in this article were the main security incidents this month, and the theft of individual users was not included in the statistics. 比特币今日价格行情网_okx交易所app_永续合约_比特币怎么买卖交易_虚拟币交易所平台

文字格式和图片示例

注册有任何问题请添加 微信:MVIP619 拉你进入群

弹窗与图片大小一致 文章转载注明 网址:https://netpsp.com/?id=57386

美化布局示例

欧易(OKX)最新版本

【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   全球官网 大陆官网

币安(Binance)最新版本

币安交易所app【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

火币HTX最新版本

火币老牌交易所【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址
可以去百度分享获取分享代码输入这里。
声明

1.本站遵循行业规范,任何转载的稿件都会明确标注作者和来源;2.本站的原创文章,请转载时务必注明文章作者和来源,不尊重原创的行为我们将追究责任;3.作者投稿可能会经我们编辑修改或补充。

发表评论
平台列表
美化布局示例

欧易(OKX)

  全球官网 大陆官网

币安(Binance)

  官网

火币(HTX)

  官网

Gate.io

  官网

Bitget

  官网

deepcoin

  官网
关注我们

若遇到问题,加微信客服---清歌

搜索
排行榜
扫一扫,加我为微信好友加我为微信好友