Web3 安全事件总损失约 3.49 亿美元

币圈资讯 阅读:45 2024-04-22 12:09:24 评论:0
美化布局示例

欧易(OKX)最新版本

【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   全球官网 大陆官网

币安(Binance)最新版本

币安交易所app【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

火币HTX最新版本

火币老牌交易所【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

概览

据慢雾区块链被黑档案库(https://hacked.slowmist.io) 统计,2023 年 11 月,共发生安全事件 47 起,总损失约 3.49 亿美元。

主要事件

Onyx Protocol

2023 年 11 月 1 日,DeFi 借贷协议 Onyx Protocol 遭攻击,损失 1,164.53 ETH,约 210 万美元。据慢雾安全团队分析,攻击者的手段与攻击 Hundred Finance 的手段相同,都是通过操纵利率的方式借入超出预期的资金实现攻击。据 MistTrack 分析,被盗资金已被转入 Tornado Cash。

TrustPad

2023 年 11 月 6 日,跨链融资平台 TrustPad 的一项质押合约遭到攻击,损失约 15.5 万美元。11 月 9 日,TrustPad 发布攻击事后分析,说明此次攻击是因为 receiveUpPool 函数没有验证 msg.sender,使得攻击者能操纵 newlockstartTime。攻击者反复调用 receiveUpPool() 和 withdraw() 来收取奖励,然后调用 stakePendingRewards 将奖励转换为质押金额。最后,攻击者通过 withdraw() 撤回奖励。

TheStandard.io

2023 年 11 月 7 日,去中心化超额抵押稳定币协议 TheStandard.io 遭攻击,损失约 29 万美元。该漏洞的关键在于 PAXG 池的低流动性,攻击者利用该漏洞操纵市场。11 月 9 日,攻击者向协议返还了 24.3 万枚 EUROs。

MEV Bot

2023 年 11 月 7 日,MEV 机器人(0x05f016765c6c601fd05a10dba1abe21a04f924a5) 被攻击,损失约一千枚 ETH。慢雾安全团队分析该攻击的核心原因是合约中用于触发套利的 0xf6ebebbb 函数缺乏认证。攻击者调用该函数,将合约中的代币兑换到 Curve 池中,然后利用闪电贷的资金进行反向兑换,并获取利润。

CoinSpot

2023 年 11 月 8 日,澳大利亚加密货币交易所 CoinSpot 疑因私钥泄露遭攻击,热钱包被盗导致超过 1,283 ETH 损失,约 247.2 万美元。

Raft Protocol

2023 年 11 月 11 日,以太坊上的稳定币协议 Raft Protocol 遭闪电贷攻击,导致 670 万枚稳定币 R 被铸造,损失约 330 万美元的 ETH。此次攻击的根本原因是在铸造份额代币时发生的精度计算问题,攻击者利用这一问题获取额外的份额代币。然而,攻击者盗走了 1,577 ETH,随后又烧掉了 1,570 ETH。攻击者在攻击前从 Tornado Cash 中提取了约 18 ETH,攻击后还剩下 14 ETH,也就是说攻击者在整个过程中损失了 4 ETH 。

Exzo Network

2023 年 11 月 14 日,Exzo Network 发布推文称,最近发生了一起针对 Exzo (XZO) 的安全漏洞,原因是所有者/管理员账户被入侵。攻击者利用被入侵的管理员钱包将 Exzo (XZO) 的“所有权”角色转移到他们的钱包中,使他们能够铸造大量的 XZO 并从 Uniswap 上的 XZO/ETH 流动性池中抽走 169 个 ETH。攻击者还将管理员钱包中总共 69 个 ETH 和剩余的 XZO 转移到自己的钱包中。

dYdX

2023 年 11 月 18 日,dYdX v3 保险基金因 YFI 清算损失约 900 万美元,CEO 称遭针对性攻击。

Kronos Research

2023 年 11 月 19 日,加密量化公司 Kronos Research 在推特发文称其一些 API 密钥遭到未经授权的访问,此次攻击造成 13,007 枚 ETH 的损失,约为 2,600 万美元。

Poloniex, HTX, Heco Bridge

2023 年 11 月 10 日,交易所 Poloniex 遭攻击。据慢雾安全团队分析统计,Poloniex 黑客攻击造成约 1.3 亿美元的损失。

2023 年 11 月 22 日,据慢雾安全团队监测,HTX(原 Huobi)的热钱包及 Heco 跨链桥遭攻击,损失达 1.133 亿美元。

Kyber Network

2023 年 11 月 23 日,Kyber Network 发布推文称 KyberSwap Elastic 遭攻击,损失约 5,470 万美元。据慢雾安全团队分析,此次攻击事件的根本原因在于计算当前价格到边界刻度价格的兑换中,所需的代币数量会因为 KyberSwap Elastic 的再投资曲线而将流动性多加上手续费复利的部分,从而造成其计算结果比预期大,可以覆盖用户兑换所需,但实际价格已经越过了边界刻度,使得协议认为当前刻度范围内的流动性已经满足了兑换所需,故而未进行流动性更新。最终导致反向兑换跨过边界刻度时流动性增加了两次,使得攻击者获得了多于预期的代币。详情可见双重流动性之殇 —— KyberSwap 巨额被黑分析。

Rug Pull

据不完全统计,本月 Rug Pull 事件达 24 起,其中 BSC 生态上跑路项目占比最高,其次为 ETH 生态,具体如下图:

总结

本月 Poloniex、HTX、Heco Bridge 损失共达 2.43 亿美元,约占本月安全事件总损失的 69%;Rug Pull 事件达 24 起,占比本月安全事件数的 51%,用户在参与项目之前应充分了解项目的背景、团队,谨慎选择投资项目;2 起流动性利用事件导致项目方受损约 5,499 万美元,项目方应加强对流动性池的监控,以有效预防和及时应对潜在的安全威胁;有 3 起安全事件是第三方提供的服务存在漏洞导致的,项目方在引入第三方服务之前应考虑其安全性,进行详细的审查和验证,也可委托安全审计公司对第三方提供的服务进行安全审计。


Overview According to the statistics of the hacking archive of slow fog blockchain, the total loss since the security incidents occurred in September is about 100 million US dollars. According to the analysis of the slow fog security team, the attacker's means are the same as those of the attack. They all borrowed more than expected funds by manipulating interest rates to achieve the attack. According to the analysis, the stolen funds have been transferred to a pledge contract of the cross-chain financing platform, and the loss is about 10,000 US dollars. The attack is because the function is not verified, so that the attacker can manipulate the attacker to repeatedly call and collect the reward, and then call to convert the reward into the pledged amount. Finally, the attacker decentralized the over-mortgaged stable currency agreement by withdrawing the reward. The key to this vulnerability lies in the low liquidity of the pool. The attacker used this vulnerability to manipulate the market. The attacker returned 10,000 pieces to the agreement. The robot was attacked and lost about 1,000 pieces. The slow fog security team analyzed the core reason of the attack. It is the function used to trigger arbitrage in the contract that lacks authentication. The attacker calls this function to convert the tokens in the contract into the pool and then use the funds of the lightning loan to make reverse conversion and gain profits. The Australian cryptocurrency exchange suspected that the private key was leaked and the hot wallet was stolen, resulting in a loss of more than about 10,000 US dollars. The stable currency agreement on the Ethereum was attacked by lightning loan, resulting in a loss of about 10,000 US dollars. The root cause of this attack was when casting share tokens. The attacker used this problem to get extra share tokens, but the attacker stole it and then burned it. The attacker extracted the contract from it before the attack, which means that the attacker lost it in the whole process. He posted a tweet saying that a targeted security hole occurred recently because the owner administrator account was invaded. The attacker used the invaded administrator wallet to transfer the ownership role to their wallet so that they could cast a large number. And took an attacker from the liquidity pool on the Internet, and transferred a total of 10 and the rest of the administrator's wallet to his own wallet. The insurance fund lost about $10,000 due to liquidation. The company tweeted that some of its keys were accessed without authorization. The attack caused a loss of about $10,000. According to the analysis and statistics of the slow fog security team, the hacker attack caused a loss of about $100 million. The original hot wallet and cross-chain bridge were attacked and lost up to hundreds of millions of dollars. A tweet was released on April, and it was said that the attacked loss was about ten thousand dollars. According to the analysis of the slow fog security team, the root cause of this attack was to calculate the number of tokens needed in the exchange of the current price to the border scale price, which would increase the liquidity and the compound interest of the handling fee because of the reinvestment curve, resulting in a larger calculation result than expected, which could cover the user's exchange needs, but the actual price has crossed the border scale, making the agreement think that the current price is higher than expected. The liquidity within the scale has met the needs of exchange, so the liquidity update was not carried out, which eventually led to the reverse exchange. When crossing the border scale, the liquidity increased twice, which made the attacker get more tokens than expected. The details show that the huge amount of double liquidity was hacked. According to incomplete statistics, this month's events accounted for the highest proportion, followed by the ecological details. The following figure summarizes that the losses this month totaled US$ 100 million, accounting for about the total loss of security incidents this month, accounting for the security of this month. Users with the number of incidents should fully understand the background of the project before participating in the project. The team carefully chooses the investment project. Liquidity utilization incidents have caused losses to the project party of about 10,000 US dollars. The project party should strengthen the monitoring of the liquidity pool to effectively prevent and timely respond to potential security threats. The security incidents are caused by loopholes in services provided by third parties. Before introducing third-party services, the project party should consider its security for detailed review and verification, or entrust a security audit company to conduct security audits on services provided by third parties. 比特币今日价格行情网_okx交易所app_永续合约_比特币怎么买卖交易_虚拟币交易所平台

文字格式和图片示例

注册有任何问题请添加 微信:MVIP619 拉你进入群

弹窗与图片大小一致 文章转载注明 网址:https://netpsp.com/?id=62749

美化布局示例

欧易(OKX)最新版本

【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   全球官网 大陆官网

币安(Binance)最新版本

币安交易所app【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址

火币HTX最新版本

火币老牌交易所【遇到注册下载问题请加文章最下面的客服微信】永久享受返佣20%手续费!

APP下载   官网地址
可以去百度分享获取分享代码输入这里。
声明

1.本站遵循行业规范,任何转载的稿件都会明确标注作者和来源;2.本站的原创文章,请转载时务必注明文章作者和来源,不尊重原创的行为我们将追究责任;3.作者投稿可能会经我们编辑修改或补充。

发表评论
平台列表
美化布局示例

欧易(OKX)

  全球官网 大陆官网

币安(Binance)

  官网

火币(HTX)

  官网

Gate.io

  官网

Bitget

  官网

deepcoin

  官网
关注我们

若遇到问题,加微信客服---清歌

搜索
排行榜
扫一扫,加我为微信好友加我为微信好友